Fix registry quarantine provenance and write integrity

[cursor]

Summary

• Reject forged registry merge payloads that use .json files or symlinked registry_fetch layouts to self-certify provenance.
• Treat allowlisted quarantine layout directories as trusted only when they are real child directories under the quarantine root.
• Make quarantine writes validate limits before staging, avoid ID collisions, commit new pairs before retention/eviction, and preserve existing evidence on write/commit failure.
• Return fail-closed quarantine_failed results from registry fetch when quarantine storage raises OSError or ValueError.

Validation

• PYTHONPATH=src python3 -m pytest tests/test_security_regressions.py tests/test_registry_ssot.py tests/test_registry_fetch_r4.py tests/test_registry_load_order_r5.py -q
• python3 -m compileall -q src/scp
• git diff --check

Note: an adjacent MCP-gates collection check is still blocked in this environment by the known pre-existing MCP 2.x / mcp.server.fastmcp mismatch.

  

[ManintheCrowds]

Audit: primary source for #60 (validate-before-write, enforce-after-commit, symlink trust, self-sidecar, write-failure regressions). Closing as superseded by #60.