feat: read and validate curated FK annotations at the pinned commit (P5)

backend/src/workspaces/registry.ts

@@ -3,6 +3,7 @@ import { lstatSync } from "node:fs";
 import { mkdir, readdir, readFile, rename, rm, writeFile } from "node:fs/promises";
 import { isAbsolute, join } from "node:path";
 import { buildInstallationContract, renderWorkspaceDocs } from "./contracts.js";
+import { parseAnnotationsYaml } from "./annotations.js";
 import { assertCatalogMatchesDescriptor, parseWorkspaceCatalogYaml, type WorkspaceCatalog, type WorkspaceCatalogEntry } from "./catalog.js";
 import {
   GitWorkspaceRepository,
@@ -581,6 +582,10 @@ export class WorkspaceRegistry {
         }
         assertCatalogMatchesDescriptor(entry, workspace);
         await this.assertEvidenceContext(workspace, safeHead);
+        const annotations = await this.repository.annotationsObject(safeHead, id);
+        if (annotations !== undefined) {
+          parseAnnotationsYaml(annotations.contents.toString("utf8"));
+        }
         const collection = workspace.semantic_index.vector_store.collection;
         const owner = collectionOwners.get(collection);
         if (owner !== undefined) {