Registry import behavior

Postgres-backed model_registry_* tables power Registry::load_from_pool, cost math, and model-string parsing. Operators and automation update the catalog through offline registry artifact import change sets or the control-plane REST upsert API.

The import surface validates canonical manifest/JSONL bundles without network access, optionally requires an allowlisted Ed25519 key, and persists the artifact, baseline, changes, findings, provenance, generator identity, and digests for review. Approval is time-limited and bound to the exact artifact, baseline, provider revision, findings, schema, contract, and generator. Apply revalidates those bindings under provider-scoped Postgres locking and commits the registry writes, revision, audit staging, and change-set status in one transaction.

Pricing cards and qualified rates are append-only. Matching cards are reused, source intervals and source change-set identifiers are retained, and removals require explicit tombstones. Rollback is a newly prepared and approved compensating artifact.

See src/lib.rs, src/registry.rs, src/cost.rs, and src/import/ for the live surface.