feat: list every viva-catalog wrapper in the registry at level listed

[jcschaff]

Stacked on #184. Merge that first; GitHub retargets this PR to main when #184's branch is deleted. This completes strategy decision 5, phase A: every wrapper appears at listed.

What this adds

• compose_api/registry/catalog.py, run with uv run python -m compose_api.registry.catalog:
  • reads viva_marketplace/modules.json from the vivarium-collective/viva-catalog repository;
  • resolves the commit each repository's branch points at today, through the GitHub API (read-only; set GITHUB_TOKEN to avoid the rate limit);
  • writes compose_api/registry/catalog.yaml, and prints what was added, re-pinned or removed.
• Re-running it is quiet. An entry whose pin has not moved is kept verbatim. A moved pin is re-stamped with the new date, which is also the ladder's rule that a new commit starts again at listed.
• catalog.yaml (generated, marked as such) has 50 entries, all at listed, each pinned to a commit. There are no module-root collisions with each other or with the curated manifest.
• load_manifest merges the catalog under manifest.yaml; an id in the curated manifest wins. Raising a wrapper therefore means adding it to manifest.yaml with its evidence, and the generated file never needs hand edits.

Behaviour

No change for current submissions. A listed entry is visible in the registry but refused on HPC, with the reason "registry entry viva-tellurium is at level listed; the service runs tested or higher". That is the ladder working as designed, and it replaces "not provided by any registered simulator", which was the less accurate message for these modules.

Nothing is written to vivarium-collective.

Not included

A scheduled workflow that re-runs the ingest and opens a PR. A pull request opened with the workflow's GITHUB_TOKEN does not trigger CI, so doing it properly needs a GitHub App or a PAT secret. That is a separate decision; for now, re-running the ingest is a one-line manual step.

Tests

tests/registry/test_catalog.py (5), without the network:

• builds entries and checks a pin that has not moved is kept verbatim;
• round-trips the YAML;
• checks the curated manifest takes precedence;
• checks the shipped catalog is all listed, pinned, and refused on the service.

Registry and API rejection tests: 37 passed. make check clean.

🤖 Generated with Claude Code