feat(integrations): add workos Stripe catalog provider

[snowmead]

Summary

• Adds the workos Stripe Projects catalog integration family as CatalogResource adapter(s).
• Follows docs/ADDING-A-PROVIDER.md and docs/PROVIDER-WAVES.md.
• Includes gap test + hermetic provision test. OUTPUT_FIELDS provisional until mise run discover.

Test plan

• Gap + hermetic tests in module
• Live mise run discover when provider is linked
• Merge after resolving additive registry.rs conflict with other family PRs

---

Note

Low Risk
Additive integration and docs; auth credential outputs are provisional until discover, with no changes to core provisioning or security paths.

Overview
Adds the WorkOS Phase 1 Stripe Projects catalog integration for workos/auth, exposing ${integrations.*.api_key} and client_id via a managed CatalogResource (WorkOSAuth, optional environment config).

Registers workos::auth in register_providers!, wires pub mod workos, and extends the catalog output drift test to include WorkOS. OUTPUT_FIELDS are provisional until mise run discover workos/auth.

Also extends stackless-provider-sdk with optional/required boolean and integer config helpers for upcoming generated adapters, documents catalog-first waves (PROVIDER-WAVES.md, DECISIONS.md, link from ADDING-A-PROVIDER.md), and adds scripts/generate_catalog_integrations.py to scaffold remaining deployables.

^{Reviewed by Cursor Bugbot for commit bc78b42. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 2 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit bc78b42. Configure here.}

[cursor]

Omitted environment breaks tier selection

Medium Severity

When integrations.*.environment is unset, build_config serializes an empty object, so catalog pricing never matches the sandbox tier keyed on environment. Tier resolution falls back to paid pricing and provisioning can treat WorkOS as needing paid confirmation even for the default sandbox path.

 

^{Reviewed by Cursor Bugbot for commit bc78b42. Configure here.}

[cursor]

Generator drops implemented provider modules

High Severity

The catalog generator rebuilds providers/mod.rs and register_providers! only from newly generated families. Entries in IMPLEMENTED (including manually landed workos/auth) are skipped for generation but never merged back, so a run after adding workos/auth to IMPLEMENTED removes pub mod workos and the WorkOS registry row and breaks the build.

 

^{Reviewed by Cursor Bugbot for commit bc78b42. Configure here.}