Add schema, sequence, signature, and release dry-run validation

[ksanrse]

Current gap

The Store repository has only a manually dispatched publish workflow. sign-catalog.mjs checks the top-level schema version/sequence and verifies that the private key matches the expected public key, but there is no pull-request CI or secret-free dry-run validating the complete catalog, replacement relationships, committed envelope, release sequence, and URLs before publication.

Because Store metadata is signed discovery input, validation should fail before a production signing key is exposed to the job.

Scope

• Extract a secret-free catalog validator with fixtures/tests.
• Validate the complete schema, required fields, unique package IDs, versions, compatibility ranges, URLs, icons, categories, replacement/deprecation chains, and bounded timestamps where applicable.
• Reject duplicate identities and cycles/ambiguity in replacement metadata.
• Verify that catalog.envelope.json decodes to the committed catalog.json and validates with the committed production public key.
• Check sequence monotonicity against the latest immutable Store release in the publish job.
• Refuse an existing release/tag before signing or uploading anything.
• Add a dry-run command that signs with an ephemeral test key and verifies the resulting envelope without production secrets.
• Add PR CI for validator tests, JSON formatting, envelope verification, and GitHub Actions syntax.
• Add a lightweight pre-commit hook for changed catalog/workflow/script files; CI remains authoritative.

Acceptance criteria

• Pull requests validate the full catalog and committed envelope without access to STORE_SIGNING_KEY.
• Duplicate IDs, invalid replacements, malformed URLs/compatibility, stale envelope bytes, and schema errors fail CI.
• Publication rejects non-monotonic sequences and existing release tags before production signing.
• The workflow signs exactly the reviewed catalog bytes and verifies the resulting signature before upload.
• Tests cover valid catalog, duplicate ID, replacement cycle, invalid sequence, wrong public key, altered bytes, and existing-tag cases.
• README documents local validation, dry-run, production publication, and key-rotation procedure.

[ksanrse]

Reviewable PR opened: #2 — secret-free catalog/envelope validation, strict byte-match mode, and CI. Monotonic release/replacement policy remains open.