feat(registry): Phase 3 — bucket-resident remote aggregation (stacked on #80)

[GondekNP]

Stacked on #80 (Phase 2). Base branch is feat/registry-provenance-phase2, not main — so the more-invasive remote/bucket work can be deeply integration-tested against the real .env bucket here before any of it reaches main. Merge #80 first, then retarget this to main.

Implements REGISTRY_PROVENANCE.md §8 — aggregate a sweep's bucket-resident CSV outputs without ingesting them into cell_data.

What's in it

• get_output_uris(label_or_hash=None, output_type="patch", current_only=True) → OutputURI — the registry's own, jar-free index of export URIs (run_outputs ⋈ job_runs ⋈ job_configs), currency-filtered. No filename regex, no hand-maintained label→hash dict.
• query_remote(variable, agg, group_by, current_only, where, cache, ...) — one scan over exactly the current runs' CSVs; provenance attached by joining on the registry-supplied filename, never by parsing the path. Nothing touches cell_data.
• check_remote_consistency() — bucket-aware sibling of check_consistency: missing_remote_output / remote_count_mismatch / orphan_remote_output.

The prerequisite fix (why this is a touch more invasive)

run_outputs.file_path stored only the object key for remote exports — ExportFileInfo.path drops the bucket, so it wasn't a usable URI (the memo's §8a "jar-free from run_outputs" assumed it was). _register_job_outputs now stores the full minio://host/key. Local paths are unchanged; URIs normalize minio://→s3:// at read time. This is the one change that touches the write path, hence the stacked-PR caution.

Deep integration testing against the real .env bucket

tests/test_remote_aggregation_integration.py runs a tiny Josh model with the real JAR, exports straight to the bucket (from MINIO_* in .env), and verifies — all passing against real GCS:

• full minio://bucket/... URIs stored;
• query_remote aggregates with cell_data left empty (the load_results=False read path);
• currency: a superseded/bad run drops out of the manifest;
• orphan_remote_output and missing_remote_output detection.

Objects are written under an isolated joshpy-phase3-test/<uuid>/ prefix and deleted on teardown via a stdlib SigV4 DELETE (no boto3 in the env). The test skips cleanly when creds are absent, so it's CI-safe.

Also

Unit tests for the helpers + local-file paths; llms-full.txt, memo §8/§10, objects.json + reference page for OutputURI. Full suite 1233 passed; 0 net-new ruff/mypy. Version → 0.0.9.26.

Notes as-built vs. spec: one job_run per job (not per replicate), so replicate is filename-derived / taken from the CSV's own column; the SweepManager.remote_export_uri jar fallback proved unnecessary since run_outputs is always populated.

🤖 Generated with Claude Code