Default-organization API endpoint for bundled-component artifacts

Default-organization API endpoint for bundled-component artifacts

Problem

Customer cells have no direct access to the default cell's object storage or to internal cell-to-cell traffic. Customer-cell access in particular is restricted to publicly accessible APIs (per-cell object storage confirmed by Tenant Scale on 2026-05-13; public-API-only access confirmed on 2026-05-17). To receive bundles, customer cells need a publicly accessible default-organization API that serves the bundle artifacts. The endpoint uses the public API surface only, with no Cells-specific trust relationship.

Scope of work

• Add an authenticated API endpoint exposed by the default organization that serves bundled-component artifacts to customer cells. Authenticated via the public auth path (instance token, service-to-service via public endpoints, or similar); no internal cell-to-cell trust relationship and no consumer-type branching.
• Two operations: list every available bundled component as (server_fqdn, full_path, semver, component name, content digest), and return one component's bundle inline in the response with its catalog metadata. Each bundled component is its own object in storage, so the API lists and serves components, not whole versions.
• The endpoint reads from already-collected bundles in the legacy cell's object storage. It does not collect on demand. The "available versions" the endpoint advertises are versions whose collection has succeeded; uncollected or collection-failed versions are not advertised.
• Full-list semantics: the list is complete on every call, with no high-water mark or delta parameter. Components are identified by (server_fqdn, full_path, semver, name). PKs are not shared across cells and must not appear in the protocol.
• Eligibility check: the endpoint serves only catalog resources with verification_level == :gitlab_maintained. Requests for resources at any other verification level are rejected. The check reads verification_level from catalog_resources (already cascaded from Namespaces::VerifiedNamespace by Namespaces::VerifyNamespaceService) — no hardcoded path list.
• Prerequisite-design alignment: Tenant Scale confirmed on 2026-05-17 that cross-cell access from customer cells to the default organization happens via publicly accessible APIs. The pattern is sanctioned. The specific shape still needs design alignment with Tenant Scale during implementation — auth mechanism within the public path and rate limiting.

Acceptance criteria

• A request with a valid auth token returns every available bundled component, and each listed component's bundle is retrievable inline.
• Versions whose collection has failed or has not yet run are not returned.
• The endpoint is reachable via the same public surface as any other gitlab.com client; no internal cell-to-cell network path is required.
• The verification-level eligibility check is enforced; requests for catalog resources whose verification_level is not :gitlab_maintained are rejected.

Dependencies

Blocked by #630810 (closed) (publish-time collection, the API serves what collection produces) and #600463 (backfill — the API cannot usefully ship until existing versions have artifacts). Blocks #599879 (sync worker).