Support the registry's new listing shape: full files, url/sha256 only on install

[kmturley]

Summary

Companion PR to open-audio-stack-registry#933, which changes the registry root and type-list endpoints (GET /, /apps, /plugins, /presets, /projects) to keep every file's compatibility fields (architectures, systems, contains, type, size, downloads, attested) at the summary tier, only omitting url/sha256 per file (previously the whole files array and older versions were considered for removal - this landed on the narrower, safer trim).

• Manager.sync() now validates that shape via a new PackageVersionSummaryValidator/PackageFileSummaryValidator (same as the full validators, but url/sha256 optional per file) instead of rejecting every package for a field it never claimed to include.
• Because every compatibility field survives at the summary tier, listing/filtering (search(), filter(), listPackages()'s architecture/system filter) now works directly off sync()'s cached data with zero extra network calls.
• Only install()/installDependency() - which need to actually download and hash-verify a file - fall back to a new fetchPackageVersion()/resolvePackageVersion() to get the full per-version payload (with url/sha256) from the org/package/version endpoint. This is triggered per-file (whether every file already has url), not by whether files exists.

Bugs found and fixed along the way

Two real crash risks surfaced once sync() started running files-present-but-url-less data through code that previously only ever saw either full data or no files at all:

• packageRecommendations() called pathGetExt(file.url) unconditionally per file - this would crash on every single sync() call the moment a version had files without urls. Now skips the url-derived checks (format recommendations) when url is absent; architecture/system tallying still runs.
• packageCompatibleFiles()'s format-exclusion check made the same pathGetExt(file.url) call even when excludedFormats was an empty array ([] is truthy in JS) - which is how every listing/filter call site passes it. Now treats "can't determine format" as "don't exclude," rather than crashing.
• packageIsVerified() updated to check url per-file instead of gating on the whole files array, so it degrades to false (not a crash) when url is missing on any file.

Test plan

• npm run format / npm run lint / npx tsc --noEmit
• npm test (233/234 passing - the one failure, Install rolls back already-installed files..., is a pre-existing ReferenceError: fileHelpers is not defined from the already-merged refactor/split-file-helpers PR [refactor] Split helpers/file.ts along its actual seams #108, unrelated to this change)
• New/updated tests cover: sync() ingesting the summary shape without rejecting packages, resolvePackageVersion() fetching the full version only when needed, listPackages()'s architecture/system filter working on synced summary data with no extra fetch, and the two crash fixes above (packageRecommendations/packageCompatibleFiles no longer throw on url-less files)

🤖 Generated with Claude Code