Harden registry release preflight

tests/test_cli.py

@@ -911,6 +911,38 @@ class TestRegistryPublishDryRun:
         assert _cmd_registry_publish(self.args(tool_dir)) == 1
         assert "Tool rejected" in capsys.readouterr().err
 
+    def test_strips_local_registry_metadata_from_payload(
+        self, tool_dir, monkeypatch
+    ):
+        import yaml
+
+        from cmdforge.cli.registry_commands import _cmd_registry_publish
+
+        config_path = tool_dir / "config.yaml"
+        config_path.write_text(
+            config_path.read_text()
+            + "registry_hash: sha256:stale\n"
+            + "registry_status: approved\n"
+            + "registry_owner: previous-owner\n"
+            + "registry_feedback: old feedback\n"
+        )
+        client = MagicMock()
+        client.publish_tool.return_value = {"preflight": {"errors": []}}
+        monkeypatch.setattr(
+            "cmdforge.cli.registry_commands.load_config",
+            lambda: SimpleNamespace(registry=SimpleNamespace(token="token")),
+        )
+        monkeypatch.setattr("cmdforge.registry_client.get_client", lambda: client)
+
+        assert _cmd_registry_publish(self.args(tool_dir)) == 0
+        payload = yaml.safe_load(client.publish_tool.call_args.args[0])
+        assert not {
+            "registry_hash",
+            "registry_status",
+            "registry_owner",
+            "registry_feedback",
+        }.intersection(payload)
+
     def test_non_mapping_config_returns_failure(self, tool_dir, capsys):
         from cmdforge.cli.registry_commands import _cmd_registry_publish