[G1] One-entry harness registry and out-of-tree local source plugins (absorb burn's collector backlog) #177

Part of #160 (group 1 — independent). Once relayhistory is the only place harnesses are added, adding one must be cheap and possible without a core release.

Problem

• Adding a local harness today touches: SOURCE_CHOICES (crates/ai-hist-core/src/lib.rs:30), shallow_providers() (crates/ai-hist/src/discover.rs:460), a ShallowSessionProvider impl (discover.rs:379), validate_options in hydrate.rs:975, the ingest_selected dispatch (hydrate.rs:1204-1225), a parser in lib.rs, relationship_capabilities (crates/ai-hist-core/src/relationships.rs:164), DISCOVERY_EXEMPTIONS, resume_command (ai-hist-core/src/lib.rs:2080), the TS CatalogSource union, MCP tool docs, and docs/session-catalog.md. The registry test (crates/ai-hist/tests/source_registry.rs) catches some drift but not all.
• JS source plugins cannot be local: HistoryPluginRegistry.register throws unless source.location === 'remote' (sdk-ts/src/delivery-plugins.ts:29), and HistorySource.location is typed 'remote' (sdk-ts/src/source-contracts.ts:49). The napi JSON intake (crates/ai-hist-napi/src/sources.rs:29-43 get_source_observation / apply_source_observations / apply_source_evidence) already accepts normalized evidence without a rebuild — only the registration gate blocks local use.
• burn carries an open collector backlog that will never be built in burn now: Gemini CLI (Cloud hosting strategy: architecture, E2E encryption, data rights, and roadmap #13), GitHub Copilot CLI (feat: add rust core tagging and opencode support #14), VS Code Copilot Chat (Cloud compliance: certifications roadmap and enterprise sales strategy #15), Qwen Code (fix: harden get_handoff selection and codex backfill (follow-ups to #12) #16), Kiro ([codex] cut over ai-hist to rust-first wrapper #17), Kimi Code (Cloud browser security: JS delivery trust model, mitigations, and CLI vs. browser comparison #18), Hermes (Add relayflows cli-sync build workflow (Relay Trail #3) #19), OpenClaw (WS-9: cloud-sync convergence mapper + outbox (Agent Relay Loop) #20), Every Code ([codex] Rust core phase 1 scaffold #21), Droid (docs(ws9): consolidate cloud-sync into one canonical end-to-end guide #23), Pi (feat(ws6): ai-hist pair check CLI primitive #24), Amp (docs(ws6): Pair + cloud-sync guides + Pair client SDK/hook #25), Roo/Kilo (feat(pair): add one-command MCP and hook setup #27, docs(pair): clarify dev-only admin auth #28), Mux (feat(learn): distill sessions into Pair signal #29), Crush (feat(login): Cloud login for ai-hist — no token handling (login-UX bridge, client side) #30), OpenHands (Fix Rust CLI help and default Cloud login #34), iFlow (fix+feat: make ai-hist sync run automatically (managed service + docs) #35), Cortex (feat: link sessions to git commits #36), Octofriend (fix: resolve Codex subagent parent IDs #98). These become relayhistory collector issues.

Scope

1. Registry consolidation: one LocalSource descriptor per harness in a single module (crates/ai-hist/src/sources/catalog.rs): { id, aliases, roots(home) -> Vec<PathBuf>, watch_roots, discovery: Box<dyn ShallowSessionProvider>, hydrate: fn(...), evidence_kinds, relationship_capabilities, resume_command: Option<fn>, fixtures_dir }. SOURCE_CHOICES, shallow_providers(), validate_options, ingest_selected, relationship_capabilities, resume_command and the "declared coverage" from the capability-honesty issue all derive from it. The registry test becomes "every descriptor has a fixture and a snapshot; every SOURCE_CHOICES value is a descriptor or an exemption".
2. Local JS source plugins: allow location: 'local' in HistorySource; local sources run inside discoverSessions/hydrateSession/sync with scope local/all, return SourceEvidenceSnapshot through the existing intake, and are subject to validate_provider_path-style root checks that the plugin declares. Update docs/remote-connectors.md → docs/source-plugins.md.
3. Rust out-of-tree providers: document how an embedder registers a ShallowSessionProvider + hydrate fn with SourceRegistry::register (sources.rs:74) — it exists; add an example crate under examples/rust-local-source/ compiled in CI.
4. Collector issue transfer: open one collector issue here per burn backlog item (title, harness store path if known, link to the burn issue), then comment on each burn issue that sourcing moved here (do not close them until burn's cutover issue lands).
5. docs/session-catalog.md "Adding a provider" rewritten around the descriptor + fixture + snapshot.

Acceptance

• Adding a fake zzz harness in a test requires touching only sources/catalog.rs + a fixture dir; the registry test and MCP/TS enum tests pass without other edits (TS gets the source list from the native addon at runtime or from a generated file).
• A local JS plugin in sdk-ts/fixtures/local-source-plugin/ registers, discovers a session, hydrates it, and the session appears in listSessionCatalog({scope:'local'}) with locations: ['local'].
• 19 collector issues exist in relayhistory, cross-linked to burn.

Out of scope

Implementing any new collector.