feat: embedded registry catalog and WASM bundle install pipeline (#283)

* feat: embedded registry catalog and WASM bundle install pipeline

Embed registry manifests at compile time so the extension catalog is
available without network access. Add tar.gz bundle support for WASM
extension downloads (tools and channels), a /api/extensions/registry
endpoint, CI job to build and publish WASM bundles on release, and
ephemeral in-memory secrets fallback so the extension manager works
even without a persistent secrets store.

Key changes:
- build.rs: collect registry/*.json into embedded_catalog.json at compile time
- src/registry/embedded.rs + catalog.rs: load embedded or on-disk catalog
- src/extensions/manager.rs: download_and_install_wasm handles tar.gz bundles,
  bare .wasm files, and separate capabilities downloads; wasm channel install
- src/channels/web/server.rs: /api/extensions/registry endpoint + no-cache headers
- src/app.rs: ephemeral InMemorySecretsStore fallback for extension manager
- registry/*.json: populate artifact download URLs for release bundles
- .github/workflows/release.yml: build-wasm-extensions CI job
- Simplified setup wizard and CLI registry commands

Co-Authored-By: Claude Opus 4.6 <[email protected]>

* fix: address PR review — archive hardening, decompression bomb guard, test fix

- Add 100 MB decompressed entry size cap to tar.gz extraction in both
  manager.rs and installer.rs to prevent decompression bombs
- Add archive.set_preserve_permissions(false) and set_unpack_xattrs(false)
  for defense-in-depth against malicious archives
- Fix test assertion logic in catalog.rs (|| → || with correct negation)
- Replace silent tar fallback in CI with explicit if/else for capabilities
- Add warning when installing without SHA256 verification

Co-Authored-By: Claude Opus 4.6 <[email protected]>

* fix: resolve clippy warning in settings.rs and enforce zero-warnings policy

Use struct initializer with ..Default::default() instead of field
reassignment. Update CLAUDE.md to codify zero clippy warnings policy —
all warnings must be fixed before committing, including pre-existing ones.

Co-Authored-By: Claude Opus 4.6 <[email protected]>

* fix: address PR review round 2 — build reliability, caps validation, naming

- build.rs: emit per-file rerun-if-changed for reliable content tracking;
  fix bundles fallback to match BundlesFile shape ({"bundles":{}})
- embedded.rs: parse catalog once via OnceLock instead of double-parsing
- manager.rs + installer.rs: add 1 MB size cap on capabilities_url downloads
  with proper error surfacing
- secrets/store.rs: rename misleading `pub mod testing` to `pub mod in_memory`
- server.rs: track installed extensions by (name, kind) tuple to avoid
  false positives across different extension kinds

Co-Authored-By: Claude Opus 4.6 <[email protected]>

---------

Co-authored-by: Claude Opus 4.6 <[email protected]>

src/cli/registry.rs

@@ -1,7 +1,5 @@
 //! Registry CLI commands for discovering and installing extensions.
 
-use std::path::PathBuf;
-
 use clap::Subcommand;
 
 use crate::registry::catalog::RegistryCatalog;
@@ -59,8 +57,20 @@ pub enum RegistryCommand {
 
 /// Run a registry command.
 pub async fn run_registry_command(cmd: RegistryCommand) -> anyhow::Result<()> {
-    let registry_dir = find_registry_dir()?;
-    let catalog = RegistryCatalog::load(&registry_dir)?;
+    // For install commands that need to build from source, a disk registry is required.
+    // For list/info, embedded manifests suffice.
+    let registry_dir = RegistryCatalog::find_dir();
+    let catalog = if let Some(ref dir) = registry_dir {
+        RegistryCatalog::load(dir)?
+    } else {
+        RegistryCatalog::load_or_embedded()?
+    };
+
+    // Resolve repo root for installer (empty path when running from binary)
+    let repo_root = registry_dir
+        .as_ref()
+        .and_then(|d| d.parent().map(|p| p.to_path_buf()))
+        .unwrap_or_default();
 
     match cmd {
         RegistryCommand::List { kind, tag, verbose } => {
@@ -68,53 +78,14 @@ pub async fn run_registry_command(cmd: RegistryCommand) -> anyhow::Result<()> {
         }
         RegistryCommand::Info { name } => cmd_info(&catalog, &name),
         RegistryCommand::Install { name, force, build } => {
-            cmd_install(&catalog, &registry_dir, &name, force, build).await
+            cmd_install(&catalog, &repo_root, &name, force, build).await
         }
         RegistryCommand::InstallDefaults { force, build } => {
-            cmd_install(&catalog, &registry_dir, "default", force, build).await
+            cmd_install(&catalog, &repo_root, "default", force, build).await
         }
     }
 }
 
-/// Find the registry directory by looking relative to the current executable or cwd.
-fn find_registry_dir() -> anyhow::Result<PathBuf> {
-    // Try relative to current directory (for dev usage)
-    let cwd = std::env::current_dir()?;
-    let candidate = cwd.join("registry");
-    if candidate.is_dir() {
-        return Ok(candidate);
-    }
-
-    // Try relative to executable (covers installed binary, target/debug/, target/release/)
-    if let Ok(exe) = std::env::current_exe()
-        && let Some(parent) = exe.parent()
-    {
-        // Walk up to 3 levels: exe dir, parent (target/release → target), grandparent (→ repo root)
-        let mut dir = Some(parent);
-        for _ in 0..3 {
-            if let Some(d) = dir {
-                let candidate = d.join("registry");
-                if candidate.is_dir() {
-                    return Ok(candidate);
-                }
-                dir = d.parent();
-            }
-        }
-    }
-
-    // Try CARGO_MANIFEST_DIR (compile-time, works in dev builds)
-    let manifest_dir = std::path::Path::new(env!("CARGO_MANIFEST_DIR"));
-    let candidate = manifest_dir.join("registry");
-    if candidate.is_dir() {
-        return Ok(candidate);
-    }
-
-    anyhow::bail!(
-        "Could not find registry/ directory. Run from the ironclaw repo root, \
-         or ensure registry/ is next to the ironclaw binary."
-    )
-}
-
 fn cmd_list(
     catalog: &RegistryCatalog,
     kind: Option<&str>,
@@ -254,16 +225,11 @@ fn cmd_info(catalog: &RegistryCatalog, name: &str) -> anyhow::Result<()> {
 
 async fn cmd_install(
     catalog: &RegistryCatalog,
-    registry_dir: &std::path::Path,
+    repo_root: &std::path::Path,
     name: &str,
     force: bool,
     prefer_build: bool,
 ) -> anyhow::Result<()> {
-    // Registry dir parent is the repo root
-    let repo_root = registry_dir
-        .parent()
-        .ok_or_else(|| anyhow::anyhow!("Cannot determine repo root from registry dir"))?;
-
     let installer = RegistryInstaller::with_defaults(repo_root.to_path_buf());
 
     let (manifests, bundle) = catalog.resolve(name)?;