registry, verdaccio, portainer: full nox modules (ADR 0044/0046)

registry (docker v2): catalog/tags/delete tools, emits image.pushed (a build's
image is now pullable). verdaccio (npm): list/info tools, emits
package.published. portainer: endpoints/stacks/containers tools — tools-only,
since its only events are the underlying containers' lifecycle, which the host
owns. Typecheck; manifests parse.

modules/verdaccio/tools/index.ts

@@ -0,0 +1,35 @@
+// verdaccio's tools — its own code (novox/hq ADR 0044), importing verdaccio's own client. They
+// return structured data; the mesh serves them through the sdk's tool harness.
+
+import { registerModuleTools, type ToolDefinition } from "@novox/mesh-sdk/tools";
+import { VerdaccioClient } from "../client.js";
+
+export function getVerdaccioTools(verdaccio: VerdaccioClient): ToolDefinition[] {
+  return [
+    {
+      name: "verdaccio_list_packages",
+      description: "List every package hosted on the private npm registry, with each one's latest version.",
+      input: {},
+      run: async () => {
+        const packages = await verdaccio.listPackages();
+        return { count: packages.length, packages };
+      },
+    },
+    {
+      name: "verdaccio_package_info",
+      description: "Details of one package on the registry: its latest tag, all published versions, and description.",
+      input: { name: { type: "string", description: "the package name, e.g. '@novox/mesh-sdk'" } },
+      run: async (args) => verdaccio.getPackageInfo(String(args.name)),
+    },
+  ];
+}
+
+// The tools exist only when a registry URL is configured; otherwise verdaccio contributes none
+// rather than failing the whole runtime.
+registerModuleTools("verdaccio", (env) => {
+  try {
+    return getVerdaccioTools(VerdaccioClient.fromEnv(env));
+  } catch {
+    return [];
+  }
+});