feat(registry): complete ATLAS-WP-0002 T02, T03, T06

T02: remove inherited capability.infotech.repo-template and template consumer
docs (statehub-register, template-validation-checklist); add
capability.infotech.config-surface-atlas and rewrite capabilities.yaml.

T03: seed 4 configuration surfaces (state-hub api-config, ops-warden
routing-catalog, reuse-surface federation-sources, ops-bridge tunnel-config)
with registry/indexes/surfaces.yaml; source-linked, no values, secret deps by
reference.

T06: add tools/validate_registry.py (schema + index gate), Makefile (make
validate), and .github/workflows/validate.yml (GitHub + Gitea Actions);
document in stack-and-commands. Verified malformed entries are rejected.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Makefile

@@ -0,0 +1,24 @@
+# config-atlas — registry validation gate (ATLAS-WP-0002-T06)
+# Markdown-first repo: no build/run, only validation.
+
+.PHONY: validate validate-schema validate-reuse validate-whitespace
+
+# Full gate run by agents and CI.
+validate: validate-schema validate-whitespace validate-reuse
+	@echo "validate: all checks passed"
+
+# Surface entries validate against the JSON Schema; index is consistent.
+validate-schema:
+	@python3 tools/validate_registry.py
+
+# No trailing whitespace / conflict markers in staged or working tree.
+validate-whitespace:
+	@git diff --check HEAD -- . && echo "validate-whitespace: OK"
+
+# Capability registry federation validation (skipped if reuse-surface absent).
+validate-reuse:
+	@if command -v reuse-surface >/dev/null 2>&1; then \
+		reuse-surface validate --root . ; \
+	else \
+		echo "validate-reuse: reuse-surface CLI not on PATH — skipped" ; \
+	fi