feat(wow): extend existing UI Registry with read-only source contracts (#139)

[EagleFox31]

Context

Closes #139. Builds on the existing UI Registry delivered in #122, rather than creating a second component distribution registry. Five duplicate backlog issues #134–#138 were closed as duplicates of #139–#143.

Changes

• ui-registry/wow-sources.json: nine reviewed external research sources, with stack and license metadata, risk and review date;
• ui-registry/schemas/wow-sources.schema.json: versioned source contract;
• ui-registry/schemas/wow-consumer.schema.json: opt-in consumer config;
• ui-registry/wow-contract.mjs: deterministic, network-free source/consumer validation, fails closed for unknown ids/fields, malformed metadata, permissions;
• ui-registry/examples/wow-react-vite-css.json: brownfield-compatible sample;
• test/wow-frontend-contract.test.mjs: scenarios for React/Vite + CSS, React/Next + Tailwind, Vue reference, malformed sources, duplicate ids, blocked installation;
• integrates those tests into the existing test:ui-registry CI gate;
• updates existing registry and architecture docs to reflect this additive model.

Explicit boundaries

• No changes to ui-registry/registry.json, provenance.json, profiles.json, native UI components, Worker/API or Cloudflare deployment contracts.
• No npm dependencies, network calls, source copying, framework migrations or third-party code execution.
• All external source entries are reference-only, executionAllowed:false. License metadata does not grant import rights.
• No edits to PostgreSQL migration PR Add PostgreSQL migration gate to Worker releases #74 or its files.
• No CI-global changes to package.json, .github/workflows/ci.yml or CI impact configuration.

Validation

Existing Impact-Aware CI runs source-contract tests as part of npm run test:ui-registry, and webapp blueprint gates for ui-registry/ changes. Merge only after those checks pass.

Follow-ups #140 (license/provenance), #141 (agent skill), #142 (adapters) will build on this contract.