feat(connectors): complete ATLAS-WP-0003 — discovery connectors (Phase 2)

T01 connector_base + docs/discovery-connectors.md (read-only/stateless,
candidate->PR->promote; `candidate` added to schema status enum; candidates/
gitignored, excluded from gate).
T02 connector_reposcoping (repo-scoping facts -> candidates; graceful degrade).
T03 connector_gitconfig (deterministic scan; real .env -> secret-ref, no values;
verified 4 real candidates from ~/state-hub).
T04 connector_featurecontrol (feature-flag surfaces linking to feature-control
keys, no eval logic; FR-12).
T05 registry_health (unowned + stale detection).
Make targets: connect-gitconfig/reposcoping/featurecontrol, registry-health.

WP-0003 finished (5/5).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Makefile

@@ -22,6 +22,18 @@ graph:
 graph-query:
 	@python3 tools/config_graph.py --surface $(SURFACE)
 
+# Discovery connectors (ATLAS-WP-0003) — emit candidates for PR review.
+connect-gitconfig:
+	@python3 tools/connector_gitconfig.py $(REPO)
+connect-reposcoping:
+	@python3 tools/connector_reposcoping.py $(REPO) $(if $(FACTS),--facts $(FACTS),)
+connect-featurecontrol:
+	@python3 tools/connector_featurecontrol.py $(if $(KEYS),--keys $(KEYS),)
+
+# Stale / unowned surface report (ATLAS-WP-0003-T05).
+registry-health:
+	@python3 tools/registry_health.py
+
 # Full gate run by agents and CI.
 validate: validate-schema validate-graph validate-tests validate-whitespace validate-reuse
 	@echo "validate: all checks passed"