CAT-G2 (provision), CAT-G2b: the forge provides go-package-registry and keeps serving the npm registry's public root

go-package-registry, mesh scope, read with no credential, is offered only by the forge module's new build, so
mesh-build-go's fetch from the Go seat waits for it (design 51, E2); its read side is the forge's Go proxy. The
npm registry's public-root stays served (ADR 0346 §6, the operator 2026-11-04). Both rows of the forge's
manifest test.

Claude-Session: https://claude.ai/code/session_01JG73KJNrH5EgFXMKKYSrig

modules/gitea/cmd/forge/forge_test.go

@@ -648,7 +648,13 @@ func TestToolsAreTheOnesTheReadmeNamesAndTheManifestBuilds(t *testing.T) {
 		t.Fatal(err)
 	}
 	var m struct {
-		Tools []string `json:"tools"`
+		Tools    []string                  `json:"tools"`
+		Serves   map[string]map[string]any `json:"serves"`
+		Provides []struct {
+			Name       string            `json:"name"`
+			Scope      string            `json:"scope"`
+			Credential map[string]string `json:"credential"`
+		} `json:"provides"`
 		Build struct {
 			Artifacts []struct {
 				From   string            `json:"from"`
@@ -664,6 +670,24 @@ func TestToolsAreTheOnesTheReadmeNamesAndTheManifestBuilds(t *testing.T) {
 	if len(m.Tools) != 0 {
 		t.Error("the manifest lists tools: its claims would offer them as both seats' verbs")
 	}
+	// CAT-G2b (ADR 0346 §6, the operator 2026-11-04): the forge keeps serving the npm registry's public root, so a lock
+	// file naming it installs as today. CAT-G2 (design 51, E2): the Go seat's read side is the provision
+	// go-package-registry, mesh scope, read with no credential, offered only by this build.
+	if root, _ := m.Serves["npm-package-registry"]["public-root"].(string); !strings.HasPrefix(root, "https://") || !strings.HasSuffix(root, "/api/packages/novox/npm/") {
+		t.Errorf("npm-package-registry serves public-root %q: the public root must stay", root)
+	}
+	if g := m.Serves["go-package-registry"]; g["go-path"] != "/api/packages/novox/go" {
+		t.Errorf("go-package-registry serves %v, want the forge's Go proxy path", g)
+	}
+	goProvided := false
+	for _, p := range m.Provides {
+		if p.Name == "go-package-registry" {
+			goProvided = p.Scope == "mesh" && p.Credential["form"] == "none"
+		}
+	}
+	if !goProvided {
+		t.Error("go-package-registry is not provided at mesh scope with no credential")
+	}
 	found := false
 	for _, a := range m.Build.Artifacts {
 		if a.From == "cmd/forge" {