docs(registry): define reliable public service contract

[ORESoftware]

Outcome

Defines the organization-wide reliability and recovery contract for the public Zed registry without claiming the currently failing service is live.

Zed supplements ecosystem-native package managers; it does not replace them.

Scope

• assigns canonical roles to zpkg.net, api.zpkg.net, registry.zpkg.net, app.zpkg.net, and the optional user.zpkg.net redirect;
• defines one metadata authority, AWS/Hetzner compute separation, readiness semantics, verified artifact mirroring, and per-cloud certification names;
• standardizes tracked SOPS ciphertext at env/enc/*.env.enc and ignored plaintext at env/dec/*.env;
• documents scoped R2 roles, recovery recipients, promotion/failover gates, and an optional Google Cloud Run standby evaluation;
• updates public READMEs, handbook, and project tracking;
• adds a fail-closed policy test to prevent contract drift.

Incident baseline

On 2026-08-20, api.zpkg.net and registry.zpkg.net returned Cloudflare HTTP 530 / Tunnel 1033, while app.zpkg.net and user.zpkg.net had no DNS. The latest dual-cloud deploy run, 31832711836, failed before render/apply because protected AWS/Hetzner deployment inputs were unavailable.

This PR is documentation and policy, not deployment evidence.

Validation

• python3 scripts/validate_public_registry_policy.py
• baseline required-file and JSON validation from .github/workflows/baseline-policy.yml
• git diff --check

All pass locally.

Dependencies and authority

Deployment remains blocked on Cloudflare control-plane access, protected AWS/Hetzner deployment identities, approved production SOPS recovery recipients and scoped R2 credentials, and selection/authorization of the single metadata database. These values must not be pasted into GitHub or Linear.

Linear project: https://linear.app/denman/project/githubcomzed-pkg-5a53230ae6cc

Linear incident document: https://linear.app/denman/document/public-registry-reliability-r2-mirroring-and-incident-recovery-2026-08-5f461fd0bb83