Expose namespace-scoped operator service catalog reads

[rmcdaniel]

Operator outcome

Implement the Server HTTP prerequisite for durable-workflow/waterline#174. Operators can browse a paginated service catalog and find the original durable Nexus call without registry mutation privileges or scanning every endpoint.

• Add eight namespace-scoped operator/admin GET routes under /api/service-catalog.
• Reuse the embedded catalog queries and views, with stable tie ordering, strict filters, bounded pages and bounded related collections.
• Preserve original caller/target/deadline/attempt data and expose the recorded terminal failure type.
• Redact foreign payload references and map authorized references through the opaque runtime transport.
• Advertise the exact read capability in cluster discovery and document the HTTP contract.

The PHP HTTP side is coordinated in Waterline #174. Native implementation and shared differential qualification remain with Server #325's owner. SDK wrappers and published Waterline API/browser inspection are subsequent consumer work, so this PR does not close #174 or Workflow #753.

Verification

Affected checks pass 127 tests / 1,153 assertions against the exact installed published Workflow 2.5.12 package. They exercise list/detail shape, same/caller/target/unrelated namespaces, scopes, stable pagination ties, strict filters, role ordering, non-disclosing 404s, original deadlines/attempts, opaque versus redacted payloads, discovery and protocol/header precedence. Existing catalog, authorization and external-payload regressions pass alongside the new read fixtures. Pint passes. Normal repository checks and published read qualification remain required. No native or full Nexus parity claim.

[rmcdaniel]

Accepted as the PHP proving contract for a separately qualified native catalog-read cohort: eight GETs with required observer namespace, role refusal, strict filters, bounded pages and related lists, stable ID ties, immutable original deadline/attempt/failure details, and opaque references withheld across payload ownership boundaries. The read contract and discovery version will be checked with the eventual published PHP tuple and actual consumers before any native parity claim.

The current SDK timer candidate stays fixed at 08171ddf2104519546c04db6a20a41ccde400b7c, already integrating #405, with the earlier reviewed timer tuple. It establishes no catalog-read, Nexus, Waterline or full aggregate qualification. PHP/read-route and consumer implementation remain with the General owner; the Rust assignment will add its native/fixture side through Server #325 after the timer qualification and cleanup.

[rmcdaniel]

Reviewed head 125dc4bb9aa12d94979ffbebfe6c76d84b760f38, tree ca170049a8273f5db066619e835b63b3e50ba037.

The eight-file change adds only the operator catalog read surface, discovery/transport wiring, contract and proving fixtures. Reads require the resolved namespace and existing operator/admin role order, reuse shared scoped queries/DTOs and do not initialize execution services. Unknown filters fail without widening visibility. Pages and nested related arrays are bounded with stable ties and explicit truncation. Original deadlines, statuses and attempts are retained. Foreign payload references are redacted before transport mapping, with explicit observer ownership. Existing role, protocol, catalog and payload tests pass alongside the new fixtures, 127 tests / 1,153 assertions. No source issue found. Normal hosted gates remain required before merge. The Rust owner accepted this PHP proving contract in comment 6112947218 for a separate native/fixture cohort, without a parity claim. SDK and Waterline consumer publication remain follow-through.

[rmcdaniel]

The release preparation in #413 completes the catalog read projection using actual committed PHP call formats. Owners receive result_envelope from ServiceCallResultEnvelope::fromCall, supporting inline Avro values and the standard authenticated opaque external envelope. Foreign observers receive result_envelope: null and no internal metadata.nexus_result copy. Original failure_type follows existing control-plane metadata priority, including service_error_type and nested typed errors.

The contract document and source regressions now cover these forms. Catalog/external transport checks pass 69 tests / 590 assertions, including real external reference envelopes and null/false/zero values. PHP SDK follow-up uses this exact field, preserves raw opaque references and refuses foreign/unverified hydration. No new stable tag has been published. Native implementation and shared corpus remain with #325's owner.