Enforce bundle scope semantics at registration (reject local public, shadow warning)

[enricopiovesan]

Summary

Implement the bundle-scope enforcement rules from the reconciliation settled 2026-07-06 (traverse-framework/registry docs/decision-log.md entry 20; governing spec produced under #548):

• Once registry sync (Implement traverse-cli registry sync #542) exists, bundle register with scope: public is rejected with an actionable error: the public tier of local state is populated only by sync from traverse-framework/registry; to test locally, register the bundle as private (the overlay already wins lookup via PreferPrivate); to actually publish, use capability publish (Implement traverse-cli capability publish #543).
• A scope: private registration that shadows a synced public identity (same id + version already present in the public tier) succeeds with a warning (cargo [patch]-style) — shadowing is the point of an overlay, but it should be visible.

Out of scope here: the publish-refusal latch for private bundles (capability publish refusing private-bundle content) — that belongs to #543's spec/implementation, per #548.

Governing Spec

• needs-spec — gated on the spec produced under Spec: public-scope reconciliation + registry_ref resolution (feeds #542/#543) #548

Depends on

• Spec: public-scope reconciliation + registry_ref resolution (feeds #542/#543) #548 — governing spec
• Implement traverse-cli registry sync #542 — sync must exist for "public tier is sync-populated" to be enforceable

Definition of Done

• bundle register with scope: public fails with a stable error naming the two legitimate paths (private registration for local testing; capability publish for publication)
• Private registration shadowing a synced public identity emits a warning and succeeds; lookup still prefers the private record (PreferPrivate unchanged)
• Existing private-overlay behavior otherwise unchanged (regression-tested)
• Error/warning shapes are machine-readable per the org's stable-error requirements

Test plan

• Post-sync fixture state: register a public bundle -> assert the specific rejection error
• Register a private bundle shadowing a synced identity -> assert warning + private precedence on lookup
• Regression: private registration of a non-shadowing identity is warning-free; PreferPrivate/PublicOnly lookup-order tests still pass