feat(release): build verified full-registry catalog candidates

tools/release/govoplan_release/publisher.py

@@ -27,7 +27,10 @@ from .candidate_artifact import validate_release_channel
 from .model import CatalogPublishResult, CatalogPublishStep
 from .module_directory import module_directory_payloads
 from .selective_catalog import read_bounded_json_source, trusted_keys_from_keyring
-from .source_provenance import catalog_source_selection, source_tag_provenance_issues
+from .source_provenance import (
+    catalog_source_selection, registered_source_origin_issues,
+    source_tag_provenance_issues,
+)
 from .version_alignment import candidate_catalog_version_issues
 from .workspace import (
     DEFAULT_WORKSPACE_ROOT,
@@ -176,6 +179,22 @@ def publish_catalog_candidate(
             for issue in version_issues
         )
         source_selection = catalog_source_selection(candidate_payload)
+        entries = [candidate_payload.get("core_release")]
+        if isinstance(candidate_payload.get("modules"), list):
+            entries.extend(candidate_payload["modules"])
+        if any(
+            isinstance(entry, dict)
+            and isinstance(entry.get("python_ref"), str)
+            and " @ https://" in entry["python_ref"]
+            for entry in entries
+        ):
+            blockers.extend(
+                f"registered source origin: {issue.describe()}"
+                for issue in registered_source_origin_issues(
+                    repo_versions=source_selection.all_versions,
+                    workspace=workspace, remote=source_remote,
+                )
+            )
         blockers.extend(
             f"source provenance: {issue.describe()}"
             for issue in source_selection.issues