Bump DEFAULT_CATALOG_PATH: google-calendar events now support PATCH

[michielbdejong]

Summary

Part of localthought/atomic-plugins#5 (Phase 1: close the calendar write-back gap). The platform-specific fix already landed in localthought/overlays as overlays#165, per AGENTS.md's "Making a platform-specific fix" workflow — this is step 3, the one-line, platform-agnostic follow-up:

• Bumps DEFAULT_CATALOG_PATH in src/config.rs to the new immutable localthought/overlays revision that adds a patch operation (with its security requirement, x-crud metadata, and the event.etag schema field) on /calendars/{calendarId}/events/{eventId}.
• Extends the existing pinned-fixture test (default_catalog_pin_selects_google_offline_and_spotify_pkce_profiles) with an assertion that Catalog::allows("google-calendar", "PATCH", ...) now returns Some.
• Updates the matching pin in identity_catalog_tests.rs's published_catalog_loads_trusted_google_and_github_identity_operations.
• Regenerates the checked-in tests/identity-catalog/google-calendar-composed.yaml and sources.json fixtures from the new pin.

No src/ runtime behavior changes — CORS If-Match/Content-Type handling and upstream header forwarding for this were already generic and already in place; only the catalog pin and its pinned-fixture coverage change.

Note on the pin's base: it targets a localthought/overlays commit built on top of the currently-deployed pin (8f29d997), not overlays' main tip — main has since gained an unrelated clockify catalog entry that fails Catalog::oauth_provider validation (oauthSecurityScheme selection is required when multiple authorization-code schemes exist), caught while running default_catalog_pin_selects_google_offline_and_spotify_pkce_profiles locally against main's tip. Worth a look independently, but out of scope here.

Deployment: merging this changes the compiled-in default only; the running service also needs a restart (and, per the parent issue, existing Google Calendar connections may need reconnecting since the events-list/get operations already request the broader calendar.events scope) before real write requests can reach the new operation. Not done as part of this PR.

Test plan

• cargo test --bin auth-proxy — 100 passed, 22 ignored (network/DB-gated), 0 failed.
• cargo test --bin auth-proxy -- --ignored (the two identity-catalog network tests) — both pass against the new live pin.
• cargo fmt --check — clean.
• Live PATCH against a real Google Calendar event — not done here; needs a deployed instance and a real connected account.

🤖 Generated with Claude Code

https://claude.ai/code/session_01YZYTjDU1jrJXXfQB1YPYLA

---

Generated by Claude Code