Roll out schema-versioned configurable validation packages

[kMutagene]

Parent: #119

Blocked by:

• Add lightweight package discovery, metadata, and schema endpoints #121
• Execute configured validation-package inputs safely and align ARCExpect arc-validate#254
• Specify schema-versioned validation package configuration and input values ARC-specification#183
• Generate validation child pipelines from validation_plan.json DataHUB#73

Goal

Coordinate release and production rollout only after every implementation/specification/DataHUB acceptance gate has passed, preserving compatibility and recording reproducible evidence on the parent EPIC.

Deployment order

• Release compatible stable ValidationPackage.Model and ValidationPackage.Codecs artifacts, Model before Codecs.
• Release stable AVPRClient and AVPRClient.Interop artifacts, Client before Interop.
• Deploy the compatible AVPR service to production.
• Verify production package-index, versions, metadata, and both schema URLs before dependent consumers use them.
• Release arc-validate/ARCExpect and publish the exact DataHUB-consumed container/image digest.
• Merge/release the ARC specification update according to that repository's release process.
• Promote the tested DataHUB runner/template changes from staging to production.

The resolver deliberately returns RegistryError against an old registry; deployment order is the compatibility mechanism. Do not add a fallback to the deprecated heavy endpoint.

Compatibility and follow-up

• Keep deprecated GET /api/v1/packages until AVPRCI and known external consumers have migrated; removal requires a separate breaking issue.
• Keep the read-only legacy config decoder/warning for its documented transition window; canonical writers never emit legacy config.
• Retain schema-less historical frontmatter decoding for immutable published packages.
• Retain every recognized versioned decoder for its declared compatibility lifetime; new writers emit the current $schema URI.
• Monitor existing logs for resolver exit-code classes, registry failures, digest mismatches, and package execution failures without adding a telemetry platform.
• Resume [Feature Request] Move model for validation_packages.yml to AVPR model/codecs ARCtrl#634 only after production stabilization; it does not block this rollout.
• Record all stable artifact versions, service/container image digests, deployment timestamps, and acceptance evidence on [Epic] Add schema-versioned configurable validation-package execution #119.

Production acceptance

• Production AVPR serves the three discovery/metadata contracts before production CLI/DataHUB calls them.
• Both AVPR schema $id URLs and the arc-validate plan-schema $id URL resolve as application/schema+json and match shipped artifact bytes.
• A production-like smoke ARC resolves, installs, and executes an exact package with boolean, numeric, and string inputs and produces the established result artifacts.
• A second smoke verifies rolling resolution remains stable within one plan and config tampering fails safely.
• Discovery requests no longer download all scripts, validate hashes, or increment download counts.
• Schema-less legacy config produces one warning and executes highest stable; canonical config produces no legacy warning.
• Every child issue links its final test/release evidence and all EPIC completion criteria are satisfied before closure.

Out of scope

Removing deprecated APIs, ARCtrl implementation, richer CWL values, pagination, ETags, or unrelated release automation.