fix: read repo YAML key in registry scripts and tighten reload-keys concurrency

[staging-devin-ai-integration]

Summary

Two small fixes:

1. bug(marketplace): plugin.yml repo field silently dropped from registry manifests #307 — plugin.yml repo field silently dropped from registry manifests
   build_registry.py and check_registry_versions.py were reading plugin.get("repository") but the YAML key in plugin.yml files is repo. Changed both scripts to plugin.get("repo"). Updated the committed parakeet 0.3.0 manifest to include the previously-missing repository field. Added unit tests to prevent regression.

2. fix(server): tighten ConcurrencyLimitLayer on reload-keys endpoint #346 — Tighten ConcurrencyLimitLayer on reload-keys endpoint
   The admin-only reload-keys endpoint was using AUTH_MAX_CONCURRENCY (64). Added a dedicated RELOAD_KEYS_MAX_CONCURRENCY constant set to 1, since this is a rare admin operation that should not run concurrently.

Closes #307
Closes #346

Review & Testing Checklist for Human

• Verify repo field now appears in generated registry manifests (run build_registry.py against a plugin with a repo: key in its plugin.yml)
• Confirm reload-keys endpoint returns 503 when a second concurrent request is made

Notes

• The committed parakeet 0.3.0 manifest was updated to include the repository field that was missing due to the bug. The .minisig signature file will need re-signing on the next registry build.
• New test file scripts/marketplace/test_build_registry.py covers the repo → repository field mapping for both scripts.

Link to Devin session: https://staging.itsdev.in/sessions/c2210ae7093d4a399c7e7a2a2d478b77
Requested by: @streamer45

[staging-devin-ai-integration]

✅ Reviewed on c17b052

View review

[staging-devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment and CI monitoring

[staging-devin-ai-integration]

Devin Review found 0 new potential issues.

View 2 additional findings in Devin Review.

Debug

Playground

[staging-devin-ai-integration]

Review

Overall: Clean, minimal fixes. Both changes are correct and well-scoped.

Must fix before merge

1. Unrelated CI commits in branch. Same as the other PRs — this branch includes d3acb21 (PR ci: enable sccache GHA backend and optimize rust-cache keys #372) and 30d0b28 (PR ci: remove SCCACHE_GHA_ENABLED to stop cache entry explosion #373) which haven't landed on main. Please rebase to drop them.

2. Parakeet manifest .minisig needs re-signing. The committed manifest.json for parakeet 0.3.0 was updated to include the repository field, but the .minisig signature file was generated against the old manifest. The registry CI check may not catch this (it compares would-be vs committed manifests, not signatures), but the next marketplace build will produce a signature mismatch. Either re-sign the manifest in this PR or note it as a follow-up.

Looks good

• plugin.get("repo") fix is the right call — matches the actual YAML key in plugin.yml files.
• RELOAD_KEYS_MAX_CONCURRENCY = 1 is appropriate for a rare admin-only endpoint.
• Test file uses importlib.util.spec_from_file_location to import the scripts — unconventional but necessary since they lack package structure. Tests cover both the present and absent repo key cases for both scripts.