feat: implement OpsCatalog extension (BRIDGE-WP-0002)

Adds the OpsCatalog subsystem: a Git-backed YAML catalog of operations
domains, targets, bridges, and actor classes. Includes catalog loader,
cross-reference validator, bridge resolver (inline-first, catalog
fallback), and new CLI commands: `bridge targets`, `bridge targets show`,
`bridge catalog list/validate/show`. Updates `up/down/restart` to resolve
bridge names from the catalog when not defined inline. 142 tests, all green.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

tests/test_catalog_resolver.py

@@ -0,0 +1,89 @@
+"""Tests for catalog resolver."""
+import pytest
+from bridge.catalog.models import (
+    ActorClass,
+    Catalog,
+    CatalogBridge,
+    CatalogDomain,
+    CatalogTarget,
+)
+from bridge.catalog.resolver import BridgeNotFound, resolve
+from bridge.models import TunnelConfig, ReconnectPolicy
+
+
+@pytest.fixture
+def catalog():
+    cat = Catalog()
+    cat.domains["d"] = CatalogDomain(id="d", name="D")
+    cat.targets["t"] = CatalogTarget(id="t", domain="d", kind="service")
+    cat.bridges["catalog-bridge"] = CatalogBridge(
+        id="catalog-bridge",
+        domain="d",
+        target="t",
+        host="catalog-host.local",
+        remote_port=19000,
+        local_port=9000,
+        ssh_user="ubuntu",
+        ssh_key="~/.ssh/catalog",
+        actor="operator.bernd",
+    )
+    cat.actors["operator.bernd"] = ActorClass(id="operator.bernd", actor_class="human")
+    return cat
+
+
+@pytest.fixture
+def inline_tunnels():
+    return {
+        "inline-bridge": TunnelConfig(
+            name="inline-bridge",
+            host="inline-host.local",
+            remote_port=18000,
+            local_port=8000,
+            ssh_user="ubuntu",
+            ssh_key="~/.ssh/inline",
+            actor="operator.bernd",
+        )
+    }
+
+
+class TestResolve:
+    def test_inline_takes_precedence(self, catalog, inline_tunnels):
+        tc = resolve("inline-bridge", catalog=catalog, inline_tunnels=inline_tunnels)
+        assert tc.host == "inline-host.local"
+
+    def test_catalog_fallback(self, catalog, inline_tunnels):
+        tc = resolve("catalog-bridge", catalog=catalog, inline_tunnels=inline_tunnels)
+        assert tc.host == "catalog-host.local"
+        assert tc.remote_port == 19000
+
+    def test_catalog_fallback_no_inline(self, catalog):
+        tc = resolve("catalog-bridge", catalog=catalog, inline_tunnels={})
+        assert tc.name == "catalog-bridge"
+
+    def test_missing_name_raises(self, catalog, inline_tunnels):
+        with pytest.raises(BridgeNotFound, match="nonexistent"):
+            resolve("nonexistent", catalog=catalog, inline_tunnels=inline_tunnels)
+
+    def test_missing_name_no_catalog_raises(self, inline_tunnels):
+        with pytest.raises(BridgeNotFound):
+            resolve("nonexistent", catalog=None, inline_tunnels=inline_tunnels)
+
+    def test_inline_bridge_returns_tunnel_config(self, catalog, inline_tunnels):
+        tc = resolve("inline-bridge", catalog=catalog, inline_tunnels=inline_tunnels)
+        assert isinstance(tc, TunnelConfig)
+
+    def test_catalog_bridge_returns_tunnel_config(self, catalog):
+        tc = resolve("catalog-bridge", catalog=catalog, inline_tunnels={})
+        assert isinstance(tc, TunnelConfig)
+
+    def test_catalog_is_none_no_inline_raises(self):
+        with pytest.raises(BridgeNotFound):
+            resolve("any-name", catalog=None, inline_tunnels={})
+
+    def test_resolve_preserves_reconnect_policy(self, catalog):
+        from bridge.models import ReconnectPolicy
+        catalog.bridges["catalog-bridge"].reconnect = ReconnectPolicy(
+            max_attempts=3, backoff_initial=2, backoff_max=30
+        )
+        tc = resolve("catalog-bridge", catalog=catalog, inline_tunnels={})
+        assert tc.reconnect.max_attempts == 3