Expose versioned editor metadata and structured project diagnostics

[jeremi]

Tracked by #399.

Outcome

Editor clients and other automation can consume the exact authoring contract and project diagnostics from the matching registryctl version without scraping human-readable error strings or duplicating private compiler rules.

Requirements

• Define a versioned, machine-readable editor metadata contract covering:
  • supported authored file roles and their matching patterns;
  • the five embedded JSON Schema documents or stable version-matched locators;
  • project authoring contract/version information;
  • the existing generated xw.v1 editor metadata.
• Define a versioned diagnostic envelope with:
  • source file;
  • stable diagnostic code;
  • severity;
  • message;
  • start and end line/column when available;
  • related locations when one authored reference conflicts with another.
• Report YAML syntax and deserialization failures through the structured envelope.
• Convert project semantic validation failures needed by editor clients to structured diagnostics instead of terminal-only anyhow chains.
• Keep the public command/library boundary narrow. The private project compiler type system should remain private unless a concrete reusable type is required.
• Preserve current bounded-file, path-confinement, symlink, and secret-handling invariants.
• Never include secret values, credential contents, environment contents, or generated private artifacts in diagnostics.

Acceptance criteria

• A documented registryctl command emits the versioned editor metadata as deterministic JSON.
• A documented command or reusable in-process API returns structured diagnostics for an invalid project without requiring stderr parsing.
• Syntax, unknown-field, invalid-reference, and cross-file semantic failures have source locations as precise as the parser/model permits.
• Diagnostic codes are stable and covered by compatibility tests.
• The output is deterministic, bounded, and redaction-tested.
• Golden valid projects return no error diagnostics.
• Existing human-facing check, test, and build behavior remains compatible.

Non-goals

• Implementing the language server transport
• Editor-specific packaging
• Executing live source tests from an editor

[jeremi]

Review notes, verified against the current tree (2026-07).

Precise locations need a parser change this ticket does not own. Authored YAML is parsed with archived serde_yaml 0.9 (parse_yaml in crates/registryctl/src/project_authoring/output.rs), which yields a location only for parse errors; parsed values carry no spans. As written, "source locations as precise as the parser/model permits" can be satisfied with file-level locations for nearly all semantic findings. Filed #401 for a span-preserving parsing layer; suggest wording the location AC here to reference it (the envelope supports ranges now, precision arrives with #401).

Make the envelope LSP-shaped. Model the diagnostic on LSP Diagnostic (zero-based range, severity, code, source, message, relatedInformation). #393 then maps one to one, and CI annotation formats convert trivially. Specify position semantics explicitly: byte offsets internally, with line/column and UTF-16 conversion at the boundary, since LSP's default position encoding is UTF-16 code units.

Stable codes need a central registry. The existing structured diagnostic type (ConfigDiagnostic in crates/registry-config-report) uses free-form string codes and targets generated config with a config path, not an authored-file span. Do not reuse it as-is, but mirroring its naming and versioning convention (for example registry.authoring.diagnostics.v1) keeps the two surfaces coherent. A central code table plus a compatibility test satisfies the stable-codes AC.

Wrap the existing metadata surface instead of duplicating it. registryctl authoring xw --format editor already emits the xw.v1 catalogue, generated from the same descriptor table that registers the Rhai helpers at runtime, with a byte-equality regeneration test (crates/registry-relay/src/rhai_worker/xw.rs). The new editor-metadata command should embed or reference that output and copy the regeneration-test pattern for its own determinism AC.

Own the version handshake here. The epic's "no silent version mixing" constraint has no concrete owner. Suggest this contract require the server/CLI to announce contract version plus registryctl version (for #393: in the initialize response), with editor clients checking a compatibility range.