docs(registry): /publisher unauthenticated note — parity with /operator (closes #3546)

[EmmaLouise2018]

Closes #3546. Refs #3538 / #3542.

#3542 documented /api/registry/operator's caller-tier response-shape rules (anonymous → public; AAO API → +members_only; profile owner → +private). Asymmetry surfaced during #3559 investigation: /api/registry/publisher (server/src/routes/registry-api.ts:5229) has no auth middleware and returns identical shape for every caller.

Documenting the asymmetry rather than introducing one. AAO membership does NOT unlock more on /publisher today — telling the caller explicitly so the docs don't oversell membership value.

What changed

• server/src/routes/registry-api.ts:669 — /publisher endpoint registration gains a description block noting "unauthenticated, identical shape for every caller. Compare to /operator for the auth-aware contrast."
• static/openapi/registry.yaml — mechanical regen via npm run build:openapi (separate commit).

Test plan

• npx vitest run server/tests/unit/openapi-coverage.test.ts — 3/3 pass.
• npx tsc --noEmit -p server/tsconfig.json — clean.

Out of scope

• Whether /publisher SHOULD become auth-aware (open product question — docs(registry): /publisher auth-aware response note (parity with /operator) #3546 explicitly defers).
• Any consumer-side change.

[bokelley]

Reviewed as part of registry-stack triage session (refs #3538). Scope is tight, tests cover behavior, changesets present, openapi regen is mechanical. Approving.

[bokelley]

Approved and ready to land — but #3563 and #3565 both touched registry-api.ts and static/openapi/registry.yaml so this needs a quick rebase against main. Could you git pull --rebase origin main, rerun npm run build:openapi, and force-push? Will merge as soon as it's green. Sorry for the order — your stack is the most coherent contribution we've had on the registry IA in months.