feat: implement OpsCatalog extension (BRIDGE-WP-0002)

Adds the OpsCatalog subsystem: a Git-backed YAML catalog of operations
domains, targets, bridges, and actor classes. Includes catalog loader,
cross-reference validator, bridge resolver (inline-first, catalog
fallback), and new CLI commands: `bridge targets`, `bridge targets show`,
`bridge catalog list/validate/show`. Updates `up/down/restart` to resolve
bridge names from the catalog when not defined inline. 142 tests, all green.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

tests/test_catalog_validator.py

@@ -0,0 +1,94 @@
+"""Tests for catalog validator."""
+import pytest
+from bridge.catalog.models import (
+    ActorClass,
+    Catalog,
+    CatalogBridge,
+    CatalogDomain,
+    CatalogTarget,
+)
+from bridge.catalog.validator import ValidationError, validate_catalog
+
+
+def _make_full_catalog() -> Catalog:
+    cat = Catalog()
+    cat.domains["coulombcore"] = CatalogDomain(id="coulombcore", name="CoulombCore")
+    cat.targets["state-hub"] = CatalogTarget(
+        id="state-hub",
+        domain="coulombcore",
+        kind="service",
+        reachable_via=["state-hub-coulombcore"],
+    )
+    cat.bridges["state-hub-coulombcore"] = CatalogBridge(
+        id="state-hub-coulombcore",
+        domain="coulombcore",
+        target="state-hub",
+        host="host.local",
+        remote_port=18000,
+        local_port=8000,
+        ssh_user="ubuntu",
+        ssh_key="~/.ssh/id_ops",
+        actor="agent.claude-coulombcore",
+    )
+    cat.actors["agent.claude-coulombcore"] = ActorClass(
+        id="agent.claude-coulombcore",
+        actor_class="automation",
+    )
+    return cat
+
+
+class TestValidateCatalog:
+    def test_valid_catalog_no_errors(self):
+        cat = _make_full_catalog()
+        errors = validate_catalog(cat)
+        assert errors == []
+
+    def test_target_domain_must_exist(self):
+        cat = _make_full_catalog()
+        cat.targets["orphan"] = CatalogTarget(
+            id="orphan", domain="nonexistent-domain", kind="service"
+        )
+        errors = validate_catalog(cat)
+        assert any("orphan" in e and "nonexistent-domain" in e for e in errors)
+
+    def test_target_reachable_via_must_exist(self):
+        cat = _make_full_catalog()
+        cat.targets["state-hub"].reachable_via.append("nonexistent-bridge")
+        errors = validate_catalog(cat)
+        assert any("nonexistent-bridge" in e for e in errors)
+
+    def test_bridge_domain_must_exist(self):
+        cat = _make_full_catalog()
+        cat.bridges["state-hub-coulombcore"].domain = "missing-domain"
+        errors = validate_catalog(cat)
+        assert any("missing-domain" in e for e in errors)
+
+    def test_bridge_target_must_exist(self):
+        cat = _make_full_catalog()
+        cat.bridges["state-hub-coulombcore"].target = "missing-target"
+        errors = validate_catalog(cat)
+        assert any("missing-target" in e for e in errors)
+
+    def test_bridge_actor_must_exist(self):
+        cat = _make_full_catalog()
+        cat.bridges["state-hub-coulombcore"].actor = "nonexistent-actor"
+        errors = validate_catalog(cat)
+        assert any("nonexistent-actor" in e for e in errors)
+
+    def test_multiple_errors_all_reported(self):
+        cat = Catalog()
+        # Target with dangling domain and reachable_via
+        cat.targets["t1"] = CatalogTarget(
+            id="t1", domain="missing", kind="service", reachable_via=["missing-bridge"]
+        )
+        # Bridge with dangling domain + target + actor
+        cat.bridges["b1"] = CatalogBridge(
+            id="b1", domain="missing", target="missing", host="h",
+            remote_port=1, local_port=2, ssh_user="u", ssh_key="k", actor="missing-actor",
+        )
+        errors = validate_catalog(cat)
+        assert len(errors) >= 4
+
+    def test_empty_catalog_is_valid(self):
+        cat = Catalog()
+        assert validate_catalog(cat) == []