fix: audit MCP Registry drift and freeze retired Sora releases

[acedatacloud-dev]

Ace's source catalog retires Sora, but the official Registry still advertises all 55 historical Sora versions as active. The September health audit also assumed 25 latest records, treated every official status as active, and checked only whether a PyPI project existed. This update compares current namespace records, verifies the exact advertised package release and website reachability, and prevents source-to-mirror sync from publishing or redeploying the retired capability.

The auditor reads all latest pages, excludes substring namespace neighbors, rejects duplicate/non-latest records, and uses the Registry's official active/deprecated/deleted state. Reports distinguish the 27 manifests from 32 active source directories and list the six active packages without a Registry manifest. Obsolete HappyHorse/OpenAI exceptions are removed; Sora's expired exception remains blocking and cannot suggest restoring the retired product.

Live checks also compare website metadata and test the advertised website separately from /health, with bounded parallel requests. Registry fetch failures produce a blocking JSON report instead of a traceback with no artifact.

PR checks run deterministic local contracts and regression tests. The daily/manual live job remains strict and uploads its report even on failure. Sora's publish build and deploy job are disabled; existing artifacts and history are retained. No Registry status, package release, deployment, API generation, or billing action has been performed by this PR.

Validation on 2026-10-12:

• python3 -m unittest: 49 tests passed, including 17 focused Registry/distribution tests.
• ruff check and ruff format --check for changed Python scripts: passed.
• README inventory, shared OAuth generation/contract, and MCP parameter-alias checks: passed.
• python3 scripts/registry_health.py --local-only: valid source manifest contracts, 27 manifests, six active directories without a manifest.
• Public readback: 27 distinct latest Registry records, all active; all 27 advertised PyPI versions have non-yanked files; all 26 in-use hosted health endpoints return 200. Sora was not called.
• Using the official list captured today as input, live package/health/website checks correctly report 27 blockers: retired Sora plus all 26 in-use website URLs returning 404. Direct urllib list fetches also timed out; that failure is separately captured as registry_unavailable, with unknown counts instead of fabricated empty results. Website correction is prepared separately in fix: repair Registry website links and preserve channel attribution #983.
• GitHub Registry v0.1 namespace/broad Ace searches return zero; a github control search returns 158 results. Upstream publication does not prove downstream ingestion.
• git diff --check: passed.

Current CI at head 0ce3b07272a5fe0e8bc8c7ca09d0da530153ad9d: 11 successful checks, one intentionally skipped live job. Both source PRs remain open and unmerged.

External blocker: the bot's Registry token has only its personal namespace permission because its AceDataCloud org membership is member. Deprecating the existing Sora records requires an organization-owner Registry token or GitHub OIDC from the owning repository. No privileged identity was substituted, and no exception was extended to hide this blocker.

Scope: seven files; monorepo source is authoritative. Mirror protection becomes effective only after this PR is merged and synced. Adversarial agent review was not requested. No merge authorization is assumed.