fix: harden WorkflowRegistry against corrupted JSON

- Normalize 'workflows' field to dict in _load() (handles corrupted
  registry where 'workflows' is a list/string/null)
- Validate top-level loaded data is a dict before using it
- Guard enable/disable commands against non-dict metadata from get()

Author: mnriem

src/specify_cli/__init__.py

@@ -5478,6 +5478,9 @@ def workflow_enable(
         raise typer.Exit(1)
 
     metadata = registry.get(workflow_id)
+    if not isinstance(metadata, dict):
+        console.print(f"[red]Error:[/red] Workflow '{workflow_id}' has corrupted registry metadata")
+        raise typer.Exit(1)
     if metadata.get("enabled", True):
         console.print(f"[yellow]Workflow '{workflow_id}' is already enabled[/yellow]")
         raise typer.Exit(0)
@@ -5506,6 +5509,9 @@ def workflow_disable(
         raise typer.Exit(1)
 
     metadata = registry.get(workflow_id)
+    if not isinstance(metadata, dict):
+        console.print(f"[red]Error:[/red] Workflow '{workflow_id}' has corrupted registry metadata")
+        raise typer.Exit(1)
     if not metadata.get("enabled", True):
         console.print(f"[yellow]Workflow '{workflow_id}' is already disabled[/yellow]")
         raise typer.Exit(0)

src/specify_cli/workflows/catalog.py

@@ -72,14 +72,20 @@ def __init__(self, project_root: Path) -> None:
 
     def _load(self) -> dict[str, Any]:
         """Load registry from disk or create default."""
+        default = {"schema_version": self.SCHEMA_VERSION, "workflows": {}}
         if self.registry_path.exists():
             try:
                 with open(self.registry_path, encoding="utf-8") as f:
-                    return json.load(f)
+                    data = json.load(f)
             except (json.JSONDecodeError, ValueError):
-                # Corrupted registry file — reset to default
-                return {"schema_version": self.SCHEMA_VERSION, "workflows": {}}
-        return {"schema_version": self.SCHEMA_VERSION, "workflows": {}}
+                return default
+            if not isinstance(data, dict):
+                return default
+            # Normalize 'workflows' to a dict in case the file is corrupted
+            if not isinstance(data.get("workflows"), dict):
+                data["workflows"] = {}
+            return data
+        return default
 
     def save(self) -> None:
         """Persist registry to disk."""