feat(registry): complete ATLAS-WP-0002 T02, T03, T06

T02: remove inherited capability.infotech.repo-template and template consumer
docs (statehub-register, template-validation-checklist); add
capability.infotech.config-surface-atlas and rewrite capabilities.yaml.

T03: seed 4 configuration surfaces (state-hub api-config, ops-warden
routing-catalog, reuse-surface federation-sources, ops-bridge tunnel-config)
with registry/indexes/surfaces.yaml; source-linked, no values, secret deps by
reference.

T06: add tools/validate_registry.py (schema + index gate), Makefile (make
validate), and .github/workflows/validate.yml (GitHub + Gitea Actions);
document in stack-and-commands. Verified malformed entries are rejected.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

registry/indexes/capabilities.yaml

@@ -1,14 +1,14 @@
 version: 1
-updated: '2026-06-24'
+updated: '2026-06-26'
 domain: infotech
 capabilities:
-  - id: capability.infotech.repo-template
-    name: Coulomb Repository Template
-    summary: Bootstrap new git repositories with agent instructions, registry scaffold, and State Hub onboarding conventions.
-    vector: D3 / A3 / C2 / R2
+  - id: capability.infotech.config-surface-atlas
+    name: Configuration Surface Atlas
+    summary: Read-first, cross-kind map and evidence layer for configuration surfaces — what configures a system, who owns it, its scope, and where the source of truth lives.
+    vector: D5 / A0 / C2 / R2
     domain: infotech
     status: draft
-    owner: repo-seed
-    path: registry/capabilities/capability.infotech.repo-template.md
-    tags: [template, bootstrap, state-hub, onboarding]
-    consumption_modes: [git clone, informational]
+    owner: config-atlas
+    path: registry/capabilities/capability.infotech.config-surface-atlas.md
+    tags: [configuration, registry, control-plane, effective-config, evidence]
+    consumption_modes: [informational, source module]

registry/indexes/surfaces.yaml

@@ -0,0 +1,40 @@
+version: 1
+updated: '2026-06-26'
+domain: infotech
+surfaces:
+  - id: surface.infotech.state-hub.api-config
+    name: State Hub API configuration
+    kind: app-config
+    summary: Runtime configuration for the Custodian State Hub API (bind host/port, database URL, environment mode).
+    owner: custodian
+    status: active
+    default_layer: company
+    security_class: operational
+    path: registry/surfaces/surface.infotech.state-hub.api-config.md
+  - id: surface.infotech.ops-warden.routing-catalog
+    name: ops-warden credential routing catalog
+    kind: policy
+    summary: Catalog mapping credential/access needs to their owning subsystem, consumed via `warden route`.
+    owner: ops-warden
+    status: active
+    default_layer: company
+    security_class: policy
+    path: registry/surfaces/surface.infotech.ops-warden.routing-catalog.md
+  - id: surface.infotech.reuse-surface.federation-sources
+    name: reuse-surface federation sources
+    kind: app-config
+    summary: Federation roster and source list defining which registries reuse-surface aggregates.
+    owner: reuse-surface
+    status: active
+    default_layer: company
+    security_class: operational
+    path: registry/surfaces/surface.infotech.reuse-surface.federation-sources.md
+  - id: surface.infotech.ops-bridge.tunnel-config
+    name: ops-bridge SSH tunnel configuration
+    kind: infra-state
+    summary: Declares the reverse SSH tunnels exposing State Hub and MCP services to remote machines.
+    owner: ops-bridge
+    status: active
+    default_layer: installation
+    security_class: operational
+    path: registry/surfaces/surface.infotech.ops-bridge.tunnel-config.md