Harden the public project registry

[DaveHomeAssist]

Summary

• remove non-public project records from the published manifest and both embedded fallbacks
• sanitize remaining public copy that referenced private inventory
• document the public-only registry contract
• validate catalog visibility, repository URLs, stable IDs, and local-only fields before fallback sync

Verified

• 61 public-safe project records
• 59 distinct public repository URLs
• both FALLBACK_MANIFEST blocks exactly match project-manifest.json
• validator passes and sync is idempotent
• no current private repository names remain in the changed public outputs

Guardrails

• no history rewrite
• no repository deletion, rename, visibility change, redirect, or merge
• project IDs and public URLs preserved

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: a2508a03cf

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Verify repository visibility, not just URL shape

When an entry uses public, unlisted, or isolated visibility but points to a private DaveHomeAssist repository, this regex accepts it because it validates only the URL syntax. npm run sync-manifest would then publish that private repository name and URL in the manifest and both HTML fallbacks while reporting the record as “public-safe,” recreating the exposure this change is intended to prevent; verify visibility through GitHub or a trusted public-repository allowlist.

Useful? React with 👍 / 👎.