feat(registry): versioned structured host registry (registry v2)

[pofallon]

Summary

Replaces the colon-delimited ~/.config/remo/known_hosts store with a versioned JSON registry.json (format v2 — named per-type fields, no positional overloading), behind a single accessor core/registry.py that owns parse / serialize / validate / advisory-lock / migrate for the CLI, providers, and web service.

What changed

• New accessor src/remo_cli/core/registry.py — the one surface every consumer reads/writes through; atomic writes (os.replace), tolerant reads (per-entry warnings, never exceptions), and fcntl advisory locking with graceful degradation.
• Seamless migration (US1) — lazy, lossless, idempotent known_hosts → registry.json, original renamed to known_hosts.v1.bak; a v2-invalid legacy entry is skipped + reported, never fatal.
• No more corruption (US2) — IPv6/colon-containing values round-trip intact; remo add accepts bracketed and bare IPv6 literals.
• One reader (US3) — web discovery/state/check collapse onto the shared read-only accessor (no side effects, read-only-mount safe).
• No lost updates (US4) — every read-modify-write is lock-wrapped.
• Version skew (US5) — setup API accepts payload v1 and v2, advertises payload_versions; the CLI aborts before any mutation if the service is behind; push delta-cache bumped to cache_version: 2.
• Thin delegates — core/known_hosts.py public API unchanged, so ~30 existing call sites need no changes.
• Docs (README, docs/web-session-interface.md, CLAUDE.md) updated.

Review fixes folded in (xhigh self-review)

1. replace_registry now uses true wholesale-replace semantics — the service removes (not renames) a stale legacy mirror, and a malformed stale mirror can no longer 500 an otherwise-valid apply.
2. put_registry apply catches RegistryError (not just OSError) → clean 500 instead of an uncaught traceback.
3. Tolerant CLI migration (skip+report a v2-invalid entry instead of aborting every command).
4. Both-present read no longer crashes on a concurrent-migration rename race.

Testing

• Full suite: 1355 passed, 17 skipped, 0 failed.
• ruff check src/remo_cli clean; mypy clean (60 files).
• All quickstart.md scenarios manually verified end-to-end.

🤖 Generated with Claude Code

https://claude.ai/code/session_01HAPB5GA4NVUgKFsVFVJDxN