fix(registry): reconcile catalog with public Studio entries

[viktormarinho]

What changed

Reconcile registry.json with the public Deco catalog in Studio before Studio switches to the static JSON catalog. The comparison used SELECT queries through the studio-pg-prd read-only MCP; no database writes were made.

The database has 96 public, listed Deco entries. The previous JSON had 117 entries, but only 86 matching IDs. Two apparent omissions were existing entries under different IDs: deco/mcp-github maps to deco/github-mcp, and deco/apify maps to apify/apify-mcp.

• Add the eight missing public entries: Deco AI Gateway, Centralize Product Image, Image Editor, Site Diagnostics, Slide Maker, System Health, Wake and YouTube Channel Admin. Six use new catalog-only app.json manifests; Wake and YouTube already have implementations here and become listed.
• Exclude nine entries marked private or unlisted in Studio: Discord MCP, Dropbox, Google Apps Script, Google Calendar Service Account, Google Maps, Mercado Libre, Mercado Pago, Todoist and Vercel. Their source manifests remain in the repository with unlisted: true.
• Sync Exa and Postman icons, Slack's display name and repository link, and 22 existing entries' verification flags. Add an optional metadata.verified field so verification can differ from provider ownership; keep the previous fallback when it is omitted.
• Regenerate the JSON from its source manifests. The result contains 116 unique entries and covers all 96 public Studio entries after accounting for the two existing ID mappings.

Intentional differences

Keep the repository's additional entries that have no Studio database row. Preserve newer repository descriptions, tags and curated documentation, including Shopify's theme editing capabilities. Keep Grafana's sites-grafana.deco.site endpoint: commit d951e71 explicitly corrected the older decocache.com address that remains in the database.

Do not copy stored README bodies, historical tool-discovery snapshots or database audit fields. New catalog-only manifests include public descriptions, endpoints, icons, tags and available tool definitions. No private tenant registry contents or database dump are committed.

Validation

• Compared every public Studio entry against the generated JSON: all 96 are represented, icons and explicit verification flags match, and endpoints match except for the documented Grafana correction.
• bun run build:registry and bun run check:registry: 116 entries, reproducible output.
• Studio's catalog schema validates all 116 entries.
• bun run fmt, bun run fmt --check, bun run lint, bun run check:auth and git diff --check passed. Lint reports warnings in existing MCP implementations.
• bun test scripts/lib/registry-payload.test.ts shared/auth.test.ts: 19 passed, zero failures.
• Type-checked the registry mapper and tests with tsc --noEmit.
• Added the verification tests to the registry CI step.

Review the listing changes and generated registry.json; run bun run check:registry to verify that future regeneration preserves them.

---

Summary by cubic

Reconciles registry.json with Studio's public catalog so listings match before Studio switches to the static JSON as its source of truth.

• Adds eight missing public entries, six via new catalog-only manifests; Wake and YouTube Channel Admin become listed.
• Marks nine entries unlisted because Studio treats them as private or unlisted; their manifests remain in the repo with unlisted: true.
• Syncs Exa and Postman icons, Slack's display name, and verification flags on 22 entries. Adds optional metadata.verified so verification can differ from ownership; falls back to the official flag when omitted.
• Regenerates the JSON from source manifests: 116 unique entries covering all 96 public Studio entries after accounting for two existing ID mappings.
• Keeps repository-only entries, newer descriptions and tags, and the corrected Grafana endpoint; adds verification tests to the registry CI step.

^{Written for commit d23316a. Summary will update on new commits.}