Split upstream source rules from generated resolved registry snapshot

[justrach]

Context

The current registry keeps curated source rules and resolved hot-path metadata in one JSON file. That is fine for the initial seeded records, but it will not scale cleanly once nanobrew starts crawling many GitHub releases.

Goal

Split the upstream metadata model into a hand-reviewed source registry and a generated lock/snapshot artifact.

Proposed shape

• Curated source registry: token, kind, upstream repo/domain allowlist, platform asset rules, cask artifacts, verification policy.
• Generated resolved snapshot: version, tag, per-platform URL/SHA256, selected release asset names, and advisory warning data.
• A generator builds the resolved snapshot from the curated source registry and GitHub release/advisory data.
• Runtime consumes only the compact resolved snapshot plus enough source metadata to install safely.

Acceptance criteria

• Generated data is deterministic and reviewable.
• Manual promotion remains possible while the generator is being developed.
• The runtime embedded snapshot remains valid and small.
• Tests cover parser compatibility for both current and split data shapes, or a documented migration path exists.