Update E2E tests for registry-based skill resolution (#4202)

* Update E2E tests for registry-based skill resolution

Plain name installs without a prior build now return 404 instead of
creating a dead-end "pending" record. Update all E2E tests that relied
on the pending path to use the build-then-install flow, and add a test
verifying the 404 behavior for unresolvable names.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* Add E2E test for registry-based skill name resolution

Exercises the full registry lookup chain end-to-end:
  1. Start an in-process OCI registry (go-containerregistry/pkg/registry)
  2. Build a skill and push it to the in-process registry
  3. Create an upstream-format registry JSON with a skill entry pointing
     to the in-process registry
  4. Configure the thv server to use that registry file
  5. Install by plain name and verify the skill resolves through the
     registry, pulls from OCI, and installs with full metadata

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* Fix E2E test failures: plain HTTP for dev, idempotent installs

Two fixes for CI failures:

1. Enable plain HTTP for the OCI registry client when TOOLHIVE_DEV=true
   so E2E tests can push/pull to an in-process httptest registry without
   TLS.

2. Update duplicate/overwrite tests to expect 201 (idempotent no-op)
   instead of 409 Conflict. With real build-then-install, reinstalling
   the same digest is correctly idempotent. The old 409 was an artifact
   of the removed pending-install path.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* Fix push assertion: expect 204 No Content, not 200

The skill push API returns 204 No Content on success.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* Temporarily skip registry lookup E2E test

The upstream registry JSON schema validation rejects the test fixture.
The in-process OCI registry, plain HTTP push, and registry update
plumbing all work (verified in prior CI runs), but the upstream format
schema requires fields beyond what the test provides. Mark as pending
until the exact schema requirements are debugged.

All other E2E tests (48/49) pass.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* Fix registry lookup E2E: add dummy server to pass validation

The upstream registry file validator requires at least one server or
group. Our test JSON had only skills with an empty servers array, which
was rejected with 502. Add a minimal dummy server entry to satisfy the
validation while keeping the focus on skill resolution.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: JAORMX

pkg/api/server.go

@@ -254,7 +254,7 @@ func (b *ServerBuilder) createDefaultManagers(ctx context.Context) error {
 			_ = store.Close()
 			return fmt.Errorf("failed to create OCI skill store: %w", ociErr)
 		}
-		ociRegistry, regErr := ociskills.NewRegistry()
+		ociRegistry, regErr := newOCIRegistryClient()
 		if regErr != nil {
 			_ = store.Close()
 			// ociStore is directory-backed with no open handles; no cleanup needed.
@@ -602,6 +602,16 @@ func createListener(address string, isUnixSocket bool) (net.Listener, string, er
 	return listener, addrType, nil
 }
 
+// newOCIRegistryClient creates an OCI registry client. In dev mode
+// (TOOLHIVE_DEV=true), plain HTTP is enabled for local test registries.
+func newOCIRegistryClient() (ociskills.RegistryClient, error) {
+	var opts []ociskills.RegistryOption
+	if os.Getenv("TOOLHIVE_DEV") == "true" {
+		opts = append(opts, ociskills.WithPlainHTTP(true))
+	}
+	return ociskills.NewRegistry(opts...)
+}
+
 // lazySkillLookup implements skillsvc.SkillLookup by resolving the registry
 // provider on each call. This ensures that registry config changes (via
 // thv config set-registry or the API) are picked up without restarting