[architect] refactor: enforce elements/targets.json image_paths ownership invariant in tests/test_catalog_conformance.py

[kubestellar-hive]

Refactor

Claimed ground: tests/test_catalog_conformance.py only (one new class,
PathOwnershipTests). No other file is touched — not elements/targets.json, not the
Justfile, not any workflow.

Cluster: the elements/targets.json manifest-integrity cluster (issue #217).

What this changes structurally

elements/targets.json calls itself the single source of truth, but it holds two
independent structures that must agree and only one was enforced:

structure	consumer	enforced before this PR
oci_images	build/manifest matrices	yes — CatalogCoverageTests, both directions against catalog/
image_paths	just changed-targets (Justfile:154-216)	no

changed-targets selects an image only when a changed file matches one of its
image_paths prefixes. An image absent from image_paths, or whose prefixes miss the
files that actually define it, can never be selected — and the pull-request build gate
then fails open, reporting success having built nothing. That is precisely the
regression class the changed-targets job was introduced to prevent (see the comment in
.github/workflows/build.yml: "a PR could be green while main went red on the merge
commit — which is exactly what happened, repeatedly").

PathOwnershipTests closes the loop with five assertions:

1. every image in oci_images has an image_paths entry;
2. every image_paths key is in oci_images;
3. each image owns the four files that define it — catalog/<n>.yaml,
   elements/oci/<n>.bst, and the <n>-runtime.bst / <n>-stack.bst that
   scripts/generate_image_elements.py emits from its record;
4. no image claims another image's defining files;
5. shared_paths still lists the gate's own inputs, and canary_image is published.

Assertion 3 reuses the prefix/exact-match semantics of the changed-targets recipe
(*/ is a directory prefix, anything else is an exact path) so the test measures the
real selector rather than an idealised one.

Why no other file changes

The committed manifest already satisfies all five assertions — this is enforcement of an
existing invariant, not a change to it. tests/test_catalog_conformance.py is already
picked up by the test_catalog*.py discovery pattern in both just catalog-check and
.github/workflows/image-catalog.yml, which already triggers on elements/** and
catalog/**. So no Justfile recipe and no workflow trigger needs editing.

Verification

$ python3 -m unittest discover -s tests -p test_catalog*.py
Ran 25 tests in 0.405s
OK

Mutation-checked — each assertion was confirmed to actually fail:

• dropping qemu-img from image_paths → "images in oci_images with no image_paths
  entry: their pull-request build gate can never select them"
• narrowing python to only elements/oci/python.bst → "python does not own
  catalog/python.yaml: a change to it would select no build target"

elements/targets.json was restored after each mutation; the diff is one file, +101/-0.

Refs #217

---

Filed by architect agent (ACMM L5 — hold-gated mode). Hold-gated: human review required.

— hive: agent=architect backend=copilot model=claude-opus-5