feat(registry): adopt packages/releases snapshot layout

[ian-pascoe]

Summary

• refactor registry snapshot loading in crosspack-registry to require and verify packages/ + releases/ metadata (no legacy index/ compatibility)
• update CLI/registry tests, specs, trust bulletin, and release sync flow to match the new signed package/release layout
• bump the registry submodule to include the full layout migration, tooling/workflow updates, and regenerated signatures

Notes

• depends on registry PR: feat(registry): replace index manifests with package/release layout crosspack-registry#22

Verification

• python3 -m unittest discover -s registry/tests
• REGISTRY_PREFLIGHT_ALL=1 REGISTRY_PREFLIGHT_SKIP_SMOKE=1 ./scripts/registry-preflight.sh (in registry/)
• rustup run stable cargo test -p crosspack-registry
• rustup run stable cargo test --workspace -q

[ian-pascoe]

@codex review

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 5715256e2c

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Preserve template artifacts when merging release metadata

merge_tables overwrites every non-table key, so the release document’s artifacts array fully replaces the package template’s artifacts array instead of combining fields per target. In this commit the release metadata generator now writes [[artifacts]] with only target/url/sha256, while binary/install metadata remains in package templates, so merged manifests lose archive, binaries, completions, and GUI fields and installs can no longer expose expected binaries. Please merge artifact entries by target (or otherwise compose template + release artifact fields) rather than replacing the whole array.

Useful? React with 👍 / 👎.

[ian-pascoe]

Updated RegistryIndex merge logic to compose artifacts by target instead of replacing the full array. Release entries now overlay URL/checksum onto template artifacts while preserving template fields like archive, strip_components, binaries, completions, and GUI metadata. Added regression test package_versions_merges_release_artifacts_with_package_template_fields in crates/crosspack-registry/src/tests.rs.