feat: harden work-record and SBOM client contracts

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a023c0-a0a3-7c03-b395-5a0d2757214d

src/repo_manager/commands/registrar_reconcile.py

@@ -22,6 +22,7 @@ import httpx
 from repo_manager.gitops import GitError, commit_paths, push_ff
 from repo_manager.parse.record import iter_record_files, parse_record_file
 from repo_manager.parse.workplan import parse_workplan_file
+from repo_manager.record_identity import scan_record_identities
 
 LOCK_PATH = Path("/tmp/repo-manager-identifier-registrar.lock")
 
@@ -379,14 +380,27 @@ def registrar_reconcile(
     """Register missing workplan/task UUIDs through one scoped child process."""
     cid = str(uuid.uuid4())
     repo = path.expanduser().resolve()
+    identity = scan_record_identities(repo)
     before = _missing_identifiers(repo)
     evidence: dict[str, Any] = {
         "repo_path": str(repo),
         "repo_slug": repo.name,
         "api_base": api_base.rstrip("/"),
         "missing_before": before,
+        "record_identity": identity,
     }
 
+    if identity["identity_collisions"]:
+        return RegistrarResult(
+            "rejected",
+            evidence,
+            {
+                "code": "record_identity_collision",
+                "message": "same canonical work-record id has conflicting or incomplete UUID assignments",
+            },
+            cid,
+        )
+
     repair_projection_id = None
     if repair_workplan and bootstrap_empty_projection:
         return RegistrarResult(