feat(registry): remove discovered agents from public surface

[EmmaLouise2018]

Summary

Removes the concept of discovered agents from the AAO public registry surface, per #3772.

The federated registry now contains only AAO-attested, member-enrolled agents and publishers. Crawler-discovered entries from adagents.json no longer surface in /api/registry/agents or /api/registry/publishers.

Removed from response schemas

• source: 'registered' | 'discovered' on FederatedAgent / FederatedPublisher
• discovered_from
• endorsed_by_publisher_member (collapsed; was added two days ago in decision(registry): how should discovered agents surface member-publisher endorsement (#3538 Problem 6) #3547)
• discovered_at
• ?source= query param on /api/registry/agents (now returns 400 with a clear error)
• sources: { registered, discovered } count blocks on list endpoints
• Per-agent source label on lookupDomain / DomainLookupResult

Renamed (/api/registry/stats)

• discovered_agents → auth_graph_agents
• discovered_publishers → auth_graph_publishers
• discovered_properties → auth_graph_properties

The graph backs the publisher-authorization lookups (lookupDomain, hasValidAdagents) and is populated from BOTH adagents.json crawls AND agent_claim attestations — so auth_graph_* is the accurate name. registered_agents / registered_publishers (the public registry counts) are unchanged.

What stays

The crawler still populates discovered_agents and discovered_publishers tables — they back the publisher-authorization graph (lookupDomain, hasValidAdagents, getSalesAgentsClaimingDomain). The change is to the public registry contract, not the crawler graph.

Backwards compatibility

Wire-visible breaking changes for any external consumer of the registry HTTP surface:

Endpoint	Before	After
GET /api/registry/agents	row carries source, discovered_from, endorsed_by_publisher_member, discovered_at; response wraps sources: {registered, discovered}	row has member only; response is {agents, count}
GET /api/registry/agents?source=...	merged set, source filter applied	400 with "source query parameter is no longer supported"
GET /api/registry/publishers	row carries source, discovered_from, discovered_at; response wraps sources block	row has member only; response is {publishers, count}
GET /api/registry/lookup/domain/{domain}	authorized_agents[] and sales_agents_claiming[] carry source: 'registered' | 'discovered'	rows carry member only when registered, omitted otherwise
GET /api/registry/stats	discovered_agents / _publishers / _properties	auth_graph_agents / _publishers / _properties

endorsed_by_publisher_member was added two days ago in #3547 and never went out in a release — collapsing it is a pre-release revert, not a wire break.

OpenAPI spec at static/openapi/registry.yaml is regenerated and reflects the new surface, including the explicit /api/registry/stats schema (was additionalProperties: {} previously).

Refs (does not close — see #3772 for remaining work)

This PR ships the schema/type/service-layer half of the issue plus the docs sweep. #3772 stays open to track the remaining table-drop migration — see the follow-up comment on that issue for the checklist.

Test plan

• npm run typecheck passes
• npm run test:server-unit passes (2,976 tests, 0 failures)
• npm run build passes
• Updated registry-reader-baseline-public-endpoints.test.ts and registry-reader-baseline-mcp.test.ts to assert the new "registered-only public surface" contract
• Added ?source=registered|discovered|<bogus> 400-rejection test
• Restored fix(registry): flip type==='buying' filter inversions to 'sales' + add sales to by_type tally #3540 polarity test (sales enriched, buying not) against the registered-only surface
• Deleted registry-discovered-endorsement.test.ts and registry-agents-source-filter.test.ts (test removed features)
• Manual: hit /api/registry/agents against staging — confirm registered agents only, no source field
• Manual: hit /api/registry/agents?source=registered against staging — confirm 400 response
• Manual: hit /api/registry/publishers against staging — confirm registered publishers only, no sources count block
• Manual: hit /api/registry/stats against staging — confirm auth_graph_* field names
• Manual: verify lookupDomain still returns authorized_agents and sales_agents_claiming with member populated where applicable