fix(registry): RegistryError on non-dict entry; atomic apply; tighten type guard + slug regex

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/tests/test_registry.py

@@ -58,6 +58,7 @@ def test_parse_initial_state_defaults_per_type():
 
 @pytest.mark.parametrize("bad,msg", [
     ("projects: []\n", "at least one"),
+    ("projects:\n  - just-a-string\n", "must be a mapping"),
     ("projects:\n  - {id: 'Bad Slug', name: A, type: document, content_repo: a}\n", "valid slug"),
     ("projects:\n  - {id: a, name: A, type: nope, content_repo: a}\n", "invalid type"),
     ("projects:\n  - {id: a, name: A, type: document}\n", "content_repo"),
@@ -92,3 +93,6 @@ def test_apply_rejects_type_change_on_existing_project():
     registry.apply_registry(registry.parse_registry(changed), "s2")  # logged + skipped, no raise
     t = db.conn().execute("SELECT type FROM projects WHERE id='default'").fetchone()["type"]
     assert t == "document"  # immutable — unchanged
+    # The deployment row IS still advanced even though the project upsert was skipped.
+    drow = db.conn().execute("SELECT registry_sha FROM deployment WHERE id=1").fetchone()
+    assert drow["registry_sha"] == "s2"