feat(catalog): display spec 026 model rights record and revoked status (#622)

[enricopiovesan]

Summary

Implements registry#622 for spec 026-model-rights-compliance: the catalog now shows each model's full rights record and never presents a revoked version as active. The static generator (generate_catalog_pages.py) and the SPA (catalog/index.html) are kept in sync.

• Model licenses card, on capability pages and on AI-model pages, for every object ai.models entry:
  • commercial_use / redistribution / derivatives badges and the derived usage class (unrestricted / evaluation-only / conditional, the same projection as the index's model_usage).
  • Links to the pinned LICENSE and NOTICE files.
  • Conversion: the listed transformations plus their description, or "shipped verbatim" when derivation: null.
  • Data obligations, shown as "not stated by the publisher" when absent rather than "none".
  • Verification status, and any rights_change note.
  • Pre-026 references render their rights as unknown, never as permission.
• The contract is authoritative for object refs. catalog/model-attribution.json stays a fallback for legacy string refs only (entry 124).
• Card footer: the old note said "Permissive upstream licenses". It now says "publisher-declared, signed, not a legal certification; unknown / conditional / forbidden are never permission".
• Revoked status:
  • gather_catalog_data.py reads revoked.json.
  • catalog-builder now passes revoked / revocation through. It whitelists output fields, so without this change the flag would never have reached catalog.json.
  • The SPA and the generator show a revoked badge that takes precedence over deprecated (header, version history, package sidebar), with the revocation date and a "Do not run: (evidence)" note.
  • The list view's toggle is now "Include deprecated and revoked versions". With it off, a group whose latest version is revoked is hidden.

Governing Spec

• 026-model-rights-compliance
• 001-registry-foundation
• 018-capability-test-coverage

Project Item

Closes #622

Definition of Done

• test_generate_catalog_pages.py covers each status and usage class (8 new tests); test_gather_catalog_data.py covers revoked entries (1 new test)
• A revoked version is never shown as active: status badge precedence and list filtering, verified in the browser

Validation

• python3 -m unittest scripts/ci/tests/test_generate_catalog_pages.py scripts/ci/tests/test_gather_catalog_data.py
• (cd capability-src/catalog-builder && cargo test): 20 tests, including the new pass-through test
• Rendered the SPA in a browser against a catalog.json built from examples/model-rights (one revoked and one active version) plus the real text.detect-entities@1.1.1 (a pre-026 reference):
  • the revoked page shows the badge, date, reason and evidence link
  • the full rights record renders
  • the pre-026 entry shows unknown rights and "not stated"
  • the AI-model page shows the usage class
  • with the toggle off, the revoked-only group is hidden
  • no console errors
• bash scripts/ci/pre_pr_check.sh

🤖 Generated with Claude Code