ci: build registry-index.json in-repo for dashboard real-time updates

Pair with the existing plugins-index.json path (which feeds the
daemon's signed install lane). registry-index.json mirrors the
dict-shaped payload the registry-worker's cron currently builds via
40+ GitHub Contents API calls — but built locally from the checked-out
tree by scripts/build-registry-index.mjs, so the worker only fetches
ONE file per category type (2 total: plugins + registry) on refresh.

Workflow now picks up content changes across all 8 category dirs
(was: plugins/ only) so dashboard updates land within seconds of a
push instead of waiting for the 02:00 UTC cron tick.

The dashboard's /api/registry endpoint reads kv_store('registry_data');
the worker's forced-refresh now writes that key with these bytes and
purges the Cache-API entry, so the next dashboard hit sees fresh
data instead of the 1h-cached previous payload.

Generated counts on first build: 11p 17h 32a 60s 44c 57pr 22w 33mcp.

.github/workflows/refresh-cache.yml

@@ -1,26 +1,34 @@
 name: Refresh registry-worker cache
 
-# On every push that changes plugins/, regenerate plugins-index.json
-# (the daemon-shaped flat array the registry-worker signs and the
-# librefang daemon installs from), commit it back, then poke the
-# worker's forced-refresh endpoint so it re-signs the new bytes
-# immediately — without this, daemon installs lag up to ~24h behind
-# the next 02:00 UTC cron tick.
+# On every push that changes any registry content, regenerate the two
+# in-repo indexes the registry-worker ingests:
+#   plugins-index.json  — daemon-shaped flat plugins array (signed)
+#   registry-index.json — dict-shaped dashboard payload (unsigned)
+# then poke the worker's forced-refresh endpoint so it pulls both
+# (2 subrequests total, regardless of registry size — important under
+# Workers Free's 50-subrequest budget) and re-signs / stores them.
 #
-# Walking the on-disk repo (instead of the worker hitting GitHub
-# Contents API per-file) keeps the worker's refresh path under the
-# Workers Free 50-subrequest budget regardless of registry size.
+# Without this, dashboard + daemon would have to wait for the next
+# 02:00 UTC cron tick to see content changes (up to ~24h delay).
 
 on:
   push:
     branches: [main]
     paths:
       - 'plugins/**'
+      - 'agents/**'
+      - 'skills/**'
+      - 'hands/**'
+      - 'channels/**'
+      - 'providers/**'
+      - 'workflows/**'
+      - 'mcp/**'
       - 'scripts/build-plugins-index.mjs'
-  workflow_dispatch: # manual trigger for ops / first-deploy
+      - 'scripts/build-registry-index.mjs'
+  workflow_dispatch:
 
 permissions:
-  contents: write   # needed to commit the regenerated index back
+  contents: write   # commit regenerated index files back
 
 jobs:
   refresh:
@@ -32,18 +40,20 @@ jobs:
         with:
           node-version: '20'
 
-      - name: Rebuild plugins-index.json
-        run: node scripts/build-plugins-index.mjs
+      - name: Rebuild indexes
+        run: |
+          node scripts/build-plugins-index.mjs
+          node scripts/build-registry-index.mjs
 
-      - name: Commit regenerated index if changed
+      - name: Commit regenerated indexes if changed
         run: |
           git config user.name "github-actions[bot]"
           git config user.email "github-actions[bot]@users.noreply.github.com"
-          git add plugins-index.json
+          git add plugins-index.json registry-index.json
           if git diff --cached --quiet; then
-            echo "plugins-index.json already up-to-date"
+            echo "indexes already up-to-date"
           else
-            git commit -m "chore: regenerate plugins-index.json"
+            git commit -m "chore: regenerate registry indexes"
             git push
           fi