fix(registry): canonicalize agent_url before registered/discovered collapse (closes #3573)

[EmmaLouise2018]

Closes #3573. Refs #3565 (the blocker, now merged).

The registered-vs-discovered collapse in FederatedIndexService.listAllAgents and lookupDomain keyed on agent_url as a raw string. A registered https://agent.example/ and a discovered https://agent.example would surface as two separate entries instead of collapsing to the registered row.

Read-side and write-side are now consistent with the catalog-side, which already uses canonicalizeAgentUrl (server/src/db/publisher-db.ts:96).

What changed

• server/src/federated-index.ts
  • New collapseKey() helper wraps the existing canonicalizeAgentUrl for in-memory map keys (lowercase, trailing slash stripped; raw fallback so we never silently drop a row).
  • listAllAgents: registeredAgents Map keyed on canonical form; discovered.agent_url canonicalized for the lookup.
  • lookupDomain: same treatment for registeredAgentUrls Map and the auth/claim member-resolution lookups.
  • recordAgentFromAdagentsJson / recordPublisherFromAgent / updateAgentMetadata: canonicalize once at the entry point so legacy discovered_agents and agent_publisher_authorizations rows store the same shape the catalog-side already enforces. Forward-only — existing rows are not migrated, per the issue's out-of-scope note.
• server/tests/unit/registry-discovered-endorsement.test.ts — three new pins:
  • registered https://shared.agent.example.com/ collapses with discovered https://shared.agent.example.com.
  • case-only host difference collapses (Shared.Agent.Example.com vs lowercase).
  • scheme mismatch (http vs https) intentionally does NOT collapse — different security posture.
• .changeset/canonicalize-agent-url-collapse.md — empty changeset (server-only fix, no protocol bump).

Test plan

• npx vitest run server/tests/unit/registry-discovered-endorsement.test.ts — 9/9 pass (6 existing + 3 new).
• npm run typecheck — clean.
• Pre-commit hook (test:unit + test:test-dynamic-imports + test:callapi-state-change + typecheck) — green.
• CI green.

Out of scope

• Migration of existing non-canonical rows in discovered_agents / agent_publisher_authorizations — issue explicitly defers; the canonicalization is forward-only. Could be a one-off cleanup PR if a sweep finds collisions.
• Member-profile write path (routes/member-profiles.ts): registered agent URLs still flow in verbatim from user input. Read-side canonicalization handles the collapse, so the user-visible bug is fixed without changing the user-facing contract on what gets stored.
• Cross-registration (e.g. example.com vs www.example.com) — separate identity question.