feat(registry): complete ATLAS-WP-0002 T02, T03, T06

T02: remove inherited capability.infotech.repo-template and template consumer
docs (statehub-register, template-validation-checklist); add
capability.infotech.config-surface-atlas and rewrite capabilities.yaml.

T03: seed 4 configuration surfaces (state-hub api-config, ops-warden
routing-catalog, reuse-surface federation-sources, ops-bridge tunnel-config)
with registry/indexes/surfaces.yaml; source-linked, no values, secret deps by
reference.

T06: add tools/validate_registry.py (schema + index gate), Makefile (make
validate), and .github/workflows/validate.yml (GitHub + Gitea Actions);
document in stack-and-commands. Verified malformed entries are rejected.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.claude/rules/stack-and-commands.md

@@ -1,7 +1,8 @@
 ## Stack
 
 - **Language:** Markdown-first registry and planning repo (no application runtime)
-- **Key deps:** State Hub ADR-001 workplans, `registry/indexes/capabilities.yaml`
+- **Key deps:** State Hub ADR-001 workplans, `registry/indexes/{capabilities,surfaces}.yaml`,
+  `schemas/surface-entry.schema.json` (validated with PyYAML + jsonschema)
 
 ## Dev Commands
 
@@ -13,16 +14,21 @@ cat SCOPE.md
 ls workplans/
 ls registry/
 
-# Validate registry entries (from reuse-surface checkout)
-reuse-surface validate --root .
-
-# Sanity-check markdown / registry edits
-git diff --check
+# Validate the registry (the CI gate — run after any registry/schema edit)
+make validate                       # schema + index + whitespace + reuse-surface
+python3 tools/validate_registry.py  # schema + index consistency only
+git diff --check                    # whitespace / conflict markers
+reuse-surface validate --root .     # capability federation (from reuse-surface checkout)
 
 # After workplan or registry edits — from ~/state-hub
 make fix-consistency REPO=config-atlas
 ```
 
-**Install / test / lint / build / run:** not applicable — this repo has no
-application runtime. Verify changes with `git diff --check` and
-`reuse-surface validate` when registry files change.
+**Validation gate (CI):** `make validate` is the single gate run by agents and CI
+(`.github/workflows/validate.yml`, read by GitHub *and* Gitea Actions). It validates
+every `registry/surfaces/*.md` against `schemas/surface-entry.schema.json`
+(forbidding inline values/secrets), checks `registry/indexes/surfaces.yaml`
+consistency, and runs `git diff --check`. Requires `pip install pyyaml jsonschema`.
+
+**Install / test / build / run:** not applicable — no application runtime. Verify
+changes with `make validate`.