Converge note-frontmatter contract to one shared zod schema

[jmchilton]

Drafted by Claude (AI assistant) on jmchilton's behalf.

Why

The note-frontmatter contract was maintained in two hand-written encodings that drifted apart:

• meta_schema.yml — ajv / JSON Schema Draft-07, used by the CLI validator.
• a parallel zod schema in site/src/content.config.ts, used by the Astro site.

They had already diverged: the prompt note type existed only in the ajv copy, and the site zod had silently dropped several regex/uniqueness constraints. This is the same two-encoding drift class that broke a prior deploy.

This PR converges them to one zod schema, imported by both the validator and the site.

What changed

• New package @galaxy-foundry/note-schema — buildNoteSchema({tags, contract, licensePolicy}) returns a discriminated union over the 9 note types, plus the canonical tags / reference-contract / license-policy loaders. This collapses what were triplicate loader copies across build-cli, site, and scripts.
• Validator went native-zod — validate.ts uses schema.safeParse and maps zod issues to the existing field: message strings. ajv is dropped from the frontmatter path (still used by cast-mold for Mold IO schemas). build-cli's lib/schema.ts / reference-contract.ts / license-policy.ts are now thin re-export shims.
• Site consumes the shared schema — content.config.ts → buildNoteSchema; new site/src/lib/registries.ts loads the registries; the two duplicate site libs are deleted. meta_schema.yml deleted. Docs + slash commands repointed.
• Restored constraints the site zod had dropped — license_file regex, companions uniqueItems + item regex, validator_bin/subcommand regex, and the prompt note type. The union is now tighter than the old flat property bag.
• Joined site to the pnpm workspace — workspace:* deps, dropped site/package-lock.json, regenerated pnpm-lock.yaml, scoped packages-* scripts to packages/*.

⚠️ Reviewer callout — deploy.yml rewrite

The Pages deploy previously used withastro/action@v3 (which detected site/package-lock.json → npm). After the workspace join, that lockfile is gone and site deps are workspace:* (npm can't resolve those), so the action would break. deploy.yml's build job is replaced with an explicit pnpm build mirroring the working packages.yml:

pnpm install --frozen-lockfile → npm run packages-build → npm run site:build → upload-pages-artifact (site/dist)

This also fixes a latent fragility: the old path relied on the packages' gitignored dist/ somehow existing; it's now built deterministically before Astro imports it. The Astro base: '/foundry' is hardcoded in astro.config.mjs, so dropping the action's implicit configure-pages is safe. The one thing not provable in CI-of-this-PR is the actual Pages deploy (deploy.yml only runs on push to main) — worth watching the first post-merge deploy run.

Verification (all green locally)

Gate	Result
pnpm install --frozen-lockfile	lockfile matches
npm run validate	224 files, 0 errors
npm run test	145 passed
npm run packages-test / -typecheck / -build / -format / -lint	pass
npm run typecheck (tsc + astro check)	0 errors
npm run smoke:packages	tarball install ok
npm run site:build (the deploy command)	353 pages

A subagent review found no constraint-parity gaps (no previously-invalid note would now validate) and no lingering references to the deleted files.

🤖 Generated with Claude Code