refactor(catalog): explicit org/repo terminology; npm targets coulomb Gitea registry

Gitea's "project/package/release" terms are overloaded, so the catalog now uses
the most explicit words:
- org  = coulomb (the Gitea organisation)
- repo = whynot-design (the Gitea repository/product) — not an org, not a scope
- npm scope @whynot and package @whynot/design are distinct from both

Changes:
- catalog schema: replace conflated `owner` with required `org` + `repo`; `owner`
  is now a derived `org/repo` slug property
- npm-config delivery is data-driven: registry + scope live in
  delivery_config.npm and are validated; engine no longer hardcodes a registry
- exec delivery writes `<scope>:registry=<url>` + scoped `:_authToken` for the
  configured Gitea registry (token still env-expanded, never written to disk)
- pilot lane points at https://gitea.coulomb.social/api/packages/coulomb/npm/,
  scope @whynot, KV path coulomb/whynot-design/npm/publish
- npm-publish-demo uses @whynot scope so dry-run resolves the Gitea registry
- docs: terminology table; routing owner shown as coulomb/whynot-design
- tests: org/repo required, npm-config validation, registry authkey mapping

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

scripts/npm-publish-demo.sh

@@ -48,9 +48,11 @@ echo "    lane ready: $(secrets-engine route whynot-design-npm-publish --json |
 
 echo "### create a scratch npm package"
 mkdir -p "$PKG"
+# Scratch package uses the @whynot scope so it maps to the coulomb Gitea npm
+# registry that secrets-engine injects (same scope as the real @whynot/design).
 cat > "$PKG/package.json" <<'EOF'
 {
-  "name": "@whynot-design/se-pilot-scratch",
+  "name": "@whynot/se-pilot-scratch",
   "version": "0.0.1",
   "description": "Scratch package proving secrets-engine exec -> npm publish wiring (dry-run).",
   "license": "MIT",