Artifact Registry: integrate Brand-List Validator on the slug-claim (Lease) path

Summary

Wire the validator into AR's Lease step so brand-reserved slugs are rejected at claim time.

Note: Split out from #193 (closed), which now tracks the MVP mechanical wiring (client, config, startup probe) delivered in !833 (merged). This issue covers the slug-claim business logic.

Deliverables

  • Query the validator during Lease, alongside the protocol-reserved and not-claimed/leased checks
  • Fail-closed: validator unreachable or 5xx -> Lease rejected (customer can retry)
  • SaaS-only: behind config; Self-Managed/Dedicated run unconfigured and skip the check
  • Opaque rejection: indistinguishable from other availability reasons (protocol-reserved, taken, cross-tenant)
  • Client timeout tuned for the one-shot Lease path
  • Tests: brand-reserved slug rejected at Lease; validator-down -> fail closed; Self-Managed config skips the check

Acceptance

Lease integrates the validator; fail-closed verified; SaaS-only gating; opaque rejection; tests green.

Dependencies

Builds on the MVP mechanical wiring (#193 (closed), !833 (merged)). BLV service contract #191 (closed), deployed endpoint #192 (closed).

References

ADR-015 Slug Policy. Registration flow: Lease step. BLV epic &22428, S17 REST management API epic &22341.

🤖 Triage Note (Artifact Registry Triage Assistant)

This issue has been automatically classified as type::feature based on its title and description.

Reasoning: The issue describes the addition of new business logic — integrating the Brand-List Validator into the slug-claim (Lease) path. This includes new behaviours such as fail-closed validation, SaaS-only feature gating, opaque rejection semantics, and client timeout tuning. These are net-new capabilities being added to the system, which clearly places this in the type::feature category rather than a bug fix or maintenance task.

The following labels have been applied:

  • type::feature
  • Category:Artifact Registry
  • devops::package
  • group::package registry

If this classification doesn't seem right, please feel free to update the labels and let us know. Thank you! 🙏

Edited by Triage and Label issues