feat(registry): persist managerdomain discovery provenance on publisher rows

[bokelley]

Refs #4200

Summary

Threads discovery_method and manager_domain from AdAgentsValidationResult (populated by #4173) through the crawler's cache write, event payloads, and API endpoints so buyers and members can distinguish direct origin-attestation from one-hop ads.txt MANAGERDOMAIN delegation.

Scope: items 1, 3, 4 from #4200. Item 2 (reverse index + queue-backed fan-out) is a tracked follow-up — the reverse index needs a bounded work queue before shipping to avoid crawl storms at Raptive-scale managed networks. Item 5 (manager recrawl endpoint) defers until the reverse index exists.

Changes

• Migration 470 (server/src/db/migrations/470_publisher_discovery_provenance.sql): ALTER TABLE publishers ADD COLUMN discovery_method TEXT CHECK (...), ADD COLUMN manager_domain TEXT. Backfill implicit via 60-min crawl cadence; nulls degrade gracefully.
• server/src/db/publisher-db.ts: UpsertAdagentsCacheInput extended with discoveryMethod? and managerDomain?; upsertAdagentsCache SQL writes both columns.
• server/src/crawler.ts: All three cacheAdagentsManifest call sites pass provenance fields. publisher.adagents_changed and publisher.adagents_discovered event payloads now include discovery_method + manager_domain.
• server/src/http.ts: /api/validate-publisher response includes both fields.
• server/src/routes/registry-api.ts: /api/public/validate-publisher response and its OpenAPI schema include both fields. /api/registry/publisher reads discovery_method + manager_domain from the DB row and surfaces them at the publisher level (not per-agent).
• server/src/schemas/registry.ts: PublisherLookupResultSchema declares discovery_method and manager_domain as nullable optional fields with .openapi() descriptions.

Non-breaking justification

All DB columns are nullable with no backfill. All new API response fields are optional and additive. No existing field removed, renamed, or made required. The source enum on PublisherAuthorizedAgentSchema is unchanged — per-agent source extension to adagents_json_via_manager is a follow-up that requires threading discoveryMethod through recordAgentFromAdagentsJson and upsertAuthorization.

Pre-PR review

• code-reviewer: approved — one blocker fixed (null → undefined for absent fields in res.json() response); one nit resolved (removed ?? undefined no-op from event payloads). Migration CHECK constraint cross-reference comment present.
• adtech-product-expert: approved after two blockers fixed: (1) PublisherLookupResultSchema now declares both fields; (2) /api/public/validate-publisher now emits both fields and its OpenAPI schema is updated. Placement of discovery provenance at publisher level (not per-agent) is correct — it describes how the manifest was found, not per-agent trust.

Nits (not fixed — noted for reviewers)

• No new unit tests for the crawler write paths or API responses. The change is narrow (threading existing values), but a regression test for cacheAdagentsManifest → DB params and /api/registry/publisher response shape would harden this path.
• manager_domain has no length guard at the DB write path; ads.txt hostnames are capped at 253 chars by RFC 1035 but no defensive truncation was added (consistent with manager_domain being a hostname, not a URL).

Triage-managed PR. This bot does not currently iterate on
review comments or PR conversation threads (only on the source
issue). To unblock:

• Push fixup commits directly: gh pr checkout <num> →
  fix → push.
• Or re-trigger: comment /triage execute on the source
  issue.

See #3121
for context.

Session: https://claude.ai/code/cse_01SX6coXKTUA3sLPB6dfcjZt

---

Generated by Claude Code