refactor(registry)!: flat configs repo, signed registry.v1 bundles

[gildesmarais]

Stack (registry v1)

Land in order:

1. html2rss — feat(registry): registry.v1 verify, catalog builder, and 0.28.0 hardening html2rss#476 ← merge first (RubyGems 0.28.0)
2. html2rss-configs — refactor(registry)!: flat configs repo, signed registry.v1 bundles #317 ← this PR
3. html2rss-web — feat(registry): index, signed sync, catalog API, and consolidation refactors html2rss-web#1097 (after first signed configs release)
4. html2rss.github.io — docs: align feed-directory and AGENTS with registry sync catalog html2rss.github.io#1245 (docs; after #1097)

What changed

• Layout — lib/html2rss/configs/** → configs/**; Ruby gem removed; test/ replaces spec/
• tool/validate — walks configs/**/*.yml via Html2rss::Config.validate_yaml
• tool/registry-build — builds dist/registry-bundle.tar.gz (configs/, manifest.json, optional manifest.sig); duplicate registry.id check; archive limits from core Archive::MAX_*
• .github/workflows/release.yml — tag push → make registry-build -- --sign → verify with Bundle.load(trust: :signed) → draft GitHub release
• 144 configs — explicit registry.id on every feed YAML
• Makefile — BUNDLE_GEMFILE=tool/Gemfile; make registry-build, make ready
• bin/rspec_changed_configs — fix ENV['BUNDLE_GEMFILE'] around system (no env: kwarg on Kernel#system)
• tool/Gemfile — html2rss from git feat/registry-v1 until 0.28.0 on RubyGems

Why

Stop shipping feed YAML as an embedded gem. Publish signed registry.v1 artifacts that #1097 syncs and verifies. Flat configs/ matches contributor mental model and registry-build layout.

Risk

• Breaking — consumers must use signed tarball + Registry::Sync, not gem 'html2rss-configs'
• Cross-repo — requires merged/released #476 0.28.0 (Html2rss::Registry::*)
• Ops — first tag needs GitHub registry-release env secrets (public key must match #1097 config/registries.yml)
• test_changed_configs — bulk migration touches all YAML; one-time maintainer waiver on merge (fix script only; no fetch-selection change)

Review map

1. tool/registry-build — manifest build, sign, limits, duplicate-id gate
2. .github/workflows/release.yml — signed release pipeline and post-build verify
3. configs/ sample + registry.id slug rules in AGENTS.md
4. tool/Gemfile + Makefile — bundle entrypoints and CI ready job
5. bin/rspec_changed_configs — CI fetch helper fix

Validation

• make ready — yamllint, rubocop, 144 configs validated, 1457 RSpec examples (fetch excluded), 0 failures
• make registry-build — local unsigned build OK; release CI requires signing secrets
• Pending push: bin/rspec_changed_configs fix + git html2rss pin refresh