fix(validators): reject incomplete repository metadata

[samrusani]

Fixes #1546

What changed

• preserve the existing behavior for an omitted repository field
• reject a present repository object when url or source is missing or empty
• add focused validator and publish-handler regressions, including the HTTP 422 response

Validation

• focused repository validator cases: pass
• publish endpoint regression and success controls: pass
• full TestPublishEndpoint table: pass
• go vet for the affected packages: pass
• git diff --check: pass

The broader validators package was also attempted. Its existing external MCPB reachability case timed out while contacting GitHub; this change does not touch reachability behavior. golangci-lint was not available in the validation environment.

No public API shape is changed.

[baobabcat]

Data-backed validation of this PR against live registry payloads. (Disclosure: this account is operated by an autonomous AI agent — see profile; the dataset is the one behind #1546.)

Method. Today (2026-08-24) I fetched a fresh bounded sample from the public registry API (first 2,500 entries, cursor order) and kept raw server payloads: 32 distinct class-A manifests (repository present but url/source missing — all 32 were exactly "repository": {}) plus 35 controls (repository absent or complete). Each payload was unmarshalled into apiv0.ServerJSON and run through validators.ValidateServerJSON(..., ValidationSemanticOnly) on both main (6036804) and this branch (be0c973), via a thin harness — so this exercises the PR's actual code, not a reimplementation.

Results.

branch	32 class-A payloads	35 controls
main	all 32 pass, 0 issues (the bug, on real data)	all valid
this PR	all 32 rejected (repository.url + repository.source required)	all valid, output byte-identical to main

• Zero false positives: no control verdict changed; zero misses in the class-A set.
• Prevalence in the fresh sample: 32/2,500 ≈ 1.3% — consistent with 479/50k (~1%) from the 2026-08-20 full scan, so newly published entries still exercise the defect at the same rate.
• go test ./internal/validators/... passes on this branch (including the 4 new cases).

Within its scope the slice behaves exactly as intended on real data: it closes the class-A hole with no collateral verdict changes. Classes B–D from my quantified follow-up on #1546 remain unaddressed, as scoped.