feat: registry query layer — shared foundation for layout manifest (#670) and impact analysis (#733) #748

Summary

PRD: docs/proposals/registry-query-layer.md

PR #737 ships .squad/repo-registry.json with module/owner/package/criticality data and low-level utilities. But both #670 (versioned file layout manifest) and #733 (PR impact analysis) need a query and analysis layer on top of that data — and they need the same one, or they'll diverge on file resolution, criticality scoring, and owner mapping.

This issue tracks building scripts/registry-query.mjs: a set of pure functions that take the repo registry + a list of file paths and return structured analysis (modules touched, owners involved, criticality distribution, risk tier, boundary crossings).

Why This Must Be One Shared Foundation

1. Single resolution algorithm. File→module uses longest-prefix matching. Independent implementations will disagree on edge cases (nested modules like src/cli/shell/ vs src/cli/).
2. Single criticality model. Both need the same tier definitions and scoring.
3. Single owner resolution. PRD: Versioned file layout manifest - single source of truth for directory structure #670 needs it for validation diagnostics; feat: PR architectural impact analysis — blast radius, module boundaries, reviewer routing #733 needs it for reviewer routing.
4. Composability. Pure function: analyzeFiles(registry, filePaths) → AnalysisResult. PRD: Versioned file layout manifest - single source of truth for directory structure #670 calls it with expected files; feat: PR architectural impact analysis — blast radius, module boundaries, reviewer routing #733 calls it with PR diff files.

API Surface

• loadRegistry(path?) — load and parse repo-registry.json
• resolveFile(filePath, registry) — single file → module/owner/package/tier
• analyzeFiles(filePaths, registry) — batch analysis with aggregates
• computeRiskTier(analysis, diffStats?) — LOW/MEDIUM/HIGH/CRITICAL per feat: PR architectural impact analysis — blast radius, module boundaries, reviewer routing #733's criteria
• getInvolvedOwners(analysis) — deduplicated, ranked owner list

Depends On

• PR feat(registry): add repo registry — machine-readable module/file/owner/criticality map #737 (repo-registry) — must merge first; provides data source + low-level utils

Feeds Into

• PRD: Versioned file layout manifest - single source of truth for directory structure #670 — versioned file layout manifest (uses query layer for criticality + template resolution)
• feat: PR architectural impact analysis — blast radius, module boundaries, reviewer routing #733 — PR impact analysis (uses query layer for batch analysis + risk scoring + reviewer routing)

Acceptance Criteria

See full PRD at docs/proposals/registry-query-layer.md for detailed criteria. Key gates:

• scripts/registry-query.mjs with 5 exported functions
• Correct resolution for all path types (source modules, nested modules, critical files, templates, unknown)
• analyzeFiles() aggregates match expected output for PR P0: @copilot accidentally deleted 361 source files on dev (commit 1ab2f5c) #631 (361 files → 18+ modules)
• computeRiskTier() implements feat: PR architectural impact analysis — blast radius, module boundaries, reviewer routing #733's exact threshold criteria
• test/registry-query.test.ts with ≥20 test cases
• Manual integration test against real PR diff

File Layout

scripts/registry-query.mjs ← NEW (this issue) test/registry-query.test.ts ← NEW (this issue)

Builds on top of #737's scripts/registry-utils.mjs and .squad/repo-registry.json.