api: reconcile v1alpha6 Repository CUE gen drift with OCI-aware validation

[jeffmccune]

Summary

• Regenerate the v1alpha6 CUE gen tree so it matches the Go source after commit df69198 made Repository.Name/Repository.URL omitempty; a plain go generate ./internal/generate/platforms run now produces no diff.
• Document the intended contract on Repository in api/core/v1alpha6/types.go: url is required unless the chart name is an oci:// reference; OCI charts specify a repository only to configure registry authentication.
• Enforce the contract with a cue.mod/pkg overlay constraint on #Chart (internal/generate/platforms/cue.mod/pkg/github.com/holos-run/holos/api/core/v1alpha6/types.cue): when a repository is present and the chart name is not oci://, repository.url is a required field. The guard flows through both core.#BuildPlan and author.#Helm.
• Add fixtures and tests: helm-no-url (non-OCI chart with repository missing url, rejected with repository.url: field is required but not present) and helm-oci (OCI chart with auth-only repository, accepted and rendered offline from the vendored chart).

Fixes HOL-1516

Test plan

• go test ./internal/component/v1alpha6/... — new Generator/Helm-oci and Generator/RepositoryURLRequired subtests pass
• make lint and make test pass
• go generate ./internal/generate/platforms produces no diff
• cue vet spot checks: non-OCI missing url rejected; OCI auth-only accepted; chart with no repository at all still accepted (local/vendored charts)

Notes

• v1beta1 shares the same optional name/url fields but its gen tree is not stale; mirroring this guard to v1beta1 is left for the v1beta1 schema work.

[cloudflare-workers-and-pages]

Deploying holos with    Cloudflare Pages

Latest commit:	0c12e41
Status:	✅  Deploy successful!
Preview URL:	https://de78333b.holos.pages.dev
Branch Preview URL:	https://feat-hol-1516-reconcile-v1al.holos.pages.dev

View logs

[jeffmccune]

Code Review — Round 1 (codex)

Findings

• internal/generate/platforms/cue.mod/pkg/github.com/holos-run/holos/api/core/v1alpha6/types.cue:9 [IMPORTANT] The schema only requires repository.url for non-OCI charts, but it does not reject repository.url for OCI charts. That contradicts the new API comment saying OCI charts "must" omit URL and "the CUE schema enforces this contract." I verified core.#Chart accepts:
  name: "oci://...", repository: { url: "https://example.com/charts" }.
  Add the missing OCI-side validation and a negative test for OCI chart plus repository.url.

Verification

Ran:

• gh pr diff 478
• go test ./internal/component/v1alpha6
• go test ./internal/generate/platforms
• targeted cue vet probes from internal/generate/platforms

Verdict: REQUEST_CHANGES

[jeffmccune]

Code Review — Round 2 (codex)

No findings.

Verdict: APPROVE

I examined every changed file in PR #478 and ran:

go test ./internal/component/v1alpha6
go test ./internal/generate/... ./internal/component/...

Both passed.