Harden M8 preflight foundation

tests/test_registry_integration.py

@@ -561,6 +561,7 @@ category: text-processing
         assert data["status"] == "validated"
         assert data["name"] == tool_name
         assert data["owner"] == slug
+        assert data["preflight"]["errors"] == []
 
     def test_publish_and_retrieve(self, session, base_url, auth_headers):
         """Test publishing a tool and retrieving it."""
@@ -588,8 +589,13 @@ tags:
         assert data["name"] == tool_name
         assert data["version"] == "1.0.0"
 
-        # Retrieve
+        # Pending public tools are hidden from anonymous callers, but remain
+        # visible to their owner while awaiting moderation.
         resp = session.get(f"{base_url}/tools/{slug}/{tool_name}")
+        assert resp.status_code == 404
+        resp = session.get(
+            f"{base_url}/tools/{slug}/{tool_name}", headers=headers
+        )
         assert resp.status_code == 200
         tool = resp.json()["data"]
         assert tool["name"] == tool_name
@@ -620,11 +626,20 @@ description: First version
         })
         assert resp.status_code == 201
 
-        # Duplicate publish
+        # An identical retry is idempotent.
         resp = session.post(f"{base_url}/tools", headers=headers, json={
             "config": config,
             "readme": ""
         })
+        assert resp.status_code == 200
+        assert resp.json()["data"]["already_published"] is True
+
+        # Different content at the same version is a real conflict.
+        changed_config = config.replace("First version", "Changed content")
+        resp = session.post(f"{base_url}/tools", headers=headers, json={
+            "config": changed_config,
+            "readme": ""
+        })
         assert resp.status_code == 409
         assert resp.json()["error"]["code"] == "VERSION_EXISTS"