fix(registry-sync): select archives and metadata by catalog role - #1092

The scheduled registry sync reads the migrations repository's main plugin.json for Atlas and includes every platform archive from its mixed release. Even a correct Atlas catalog is rewritten with migrations capabilities and all 14 archives, then rejected by the registry validator.

Select archives and source metadata using the catalog directory plus repository: full GitHub/migrations plugin families and Atlas's four archives with plugin.atlas.json. Apply that selection to version eligibility, same-version repair, capability verification, and both strict target snapshots. Missing/duplicate required archives or wrong/missing Atlas metadata fail without writing that manifest; affected repair and verification errors propagate under --fix.

Validation:

• 63 registry-sync tests passed locally with Go 1.27.2, including 11 focused role tests and actual built-CLI coverage.
• Baseline tests reproduced mixed archives, wrong capabilities, false success and cross-family collisions before the fix.
• Local replay with captured v0.4.1 source metadata and release asset digests reproduced both original validator violations with the old CLI. The fixed CLI restored the checked-in four-archive Atlas catalog, passed the unchanged production validator and remained byte-stable on a second sync.
• Independent review completed; its capability-error propagation finding is fixed and regression-tested.
• git diff --check passed.

Strict target/report mode retains whole-release identity/checksum binding, source-commit pinning, and rejection of the actual Atlas source version 0.0.0. Performance is unassessed. This PR changes code, tests and documentation only; release publication and the registry consumer pin are separate follow-ups.

Incident: https://github.com/GoCodeAlone/workflow-registry/actions/runs/40070146873
Prior catalog-only correction: GoCodeAlone/workflow-registry#721