feat(breg): add resumable registry starter journeys

[jeremi]

Summary

Add a maintained path from a prepared BReg project to sample loading, a first record and an independently reviewed correction. bregctl examples list/run executes fixed scenarios against the project's owned local dev instance and resumes interrupted mutations with their original request evidence and idempotency keys.

• Add bounded, owner-only execution attempts, typed record references, explicit review steps and retained-state recovery. Whole-scenario preflight checks every declared operation and rejects aliases nested outside advertised reference fields before writes. Refactor fixture reference handling into the shared interpreter.
• Extend the BReg Rust client with inert create/lifecycle recovery evidence that is revalidated against current caller-filtered authority, plus bounded revision retrieval.
• Add four complete starter projects: public organizations, agricultural holdings, professional licences and seed lots. Each includes synthetic data, an independent first record, fixed reviewed corrections and normal/security journeys.
• Refresh the pinned offline PublicSchema draft through its owning snapshot pipeline and regenerate CLI reference outputs. The broad CLI-page diff is the generator's shared catalogue fingerprint update.

The static configurator and ZIP assembler live in a separate repository and are not part of this PR.

Checks

• Before rebase: BRegctl library tests passed (268 tests); the two opt-in native entrypoints were exercised separately where applicable. After rebase onto current main: five focused example unit tests, the full native recovery/preflight regression, 68 BReg client tests and all four PostgreSQL starter policy tests passed.
• All four maintained PostgreSQL starter policy regressions passed, including actual-principal reviewer exclusion, reader disclosure/write refusals and typed-reference checks.
• Eight emitted-project journeys passed across all four starters with sample and empty starts: compile, first record, submit/inspect/approve/apply, history and retained restart.
• Native recovery regression passed against the real API/database: interrupted committed create/apply replay, changed-input and wrong-alias refusals, concurrent attempt exclusion, reclaimed-generation refusal, and deleted-sample preservation across retry/restart.
• Client HTTP recovery boundaries, shared references, starter compiler preflight and PublicSchema snapshot tests passed. Final native regression also verifies missing revision/rejection permissions and nested aliases are refused before writes, while ordinary structured values remain supported.
• BReg contracts gate passed, including source neutrality, schema/fixture regeneration comparisons and 112 Python tests. Focused Rust Clippy/format, CI classification/actionlint and generated-doc checks passed.

Notes

Security review covered saved request evidence, current authority revalidation, private attempt state, typed references, independent review and disclosure. Saved evidence is not authority; the runtime still enforces authorization, preconditions and exact replay. Teaching clients are synthetic local identities. No production authentication or permission bypass is introduced.

PublicSchema vocabulary remains explicitly draft and attributed. The models have intentionally bounded semantics and do not claim certification or legal readiness. Target-reading planner behavior tracked in #922 remains separate.

The lockfile adds the workspace BReg client dependency and UUID serde feature; it does not upgrade external package versions. This is source-built candidate verification, not released-installer, platform-matrix or publication acceptance.

DCO

• Every commit includes a Signed-off-by trailer.
• I reviewed the submitted changes and am responsible for the contribution.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-08T11:22:34.317066Z	b9db420	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 76ba7121b4

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".