fix: merge external manifest schema into runtime registrations

[willgriffin]

Summary

• merge manifest metadata into already-registered runtime classes even when the manifest arrives under the same qualified key
• preserve STI/shared-table schema data, validation metadata, tenant-scoping metadata, and manifest-only fields on external runtime classes
• add a regression for the downstream register.js then manifest-discovery flow that was leaving db:migrate/db:ci:verify with base-only shared tables

Verification

• pnpm --dir packages/core exec vitest run src/__tests__/external-runtime-hydration.test.ts src/__tests__/downstream-events-sti-schema.test.ts src/__tests__/issue-1102-ensure-schema-merged-sti.test.ts
• pnpm --dir packages/core build
• downstream proof with the local patched core/cli against anytown dashboard consumer output showed merged shared-table columns on:
  • events: includes agenda_url, council_id
  • contents: includes meeting_id, council_id
  • properties: includes database_url, database_name

[Copilot]

Pull request overview

This PR improves SMRT’s manifest/runtime hydration behavior so that when an external manifest entry is registered after a runtime class (including the same qualified key), schema/field/method metadata is merged into the existing registration—aiming to preserve STI/shared-table columns and tenancy/validation metadata during downstream “register.js → manifest discovery” flows.

Changes:

• Add mergeManifestIntoExistingRegistration() and expand registerFromManifest() to merge manifest fields/methods/schema/decorator config into existing registrations (including same qualified key).
• Inject/normalize tenant-scoped config and ensure tenantId field presence during merges.
• Add a regression test covering schema merge into an already-registered external runtime class with the same qualified key; extend secrets tests around tenant-scoped audit failures.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
packages/secrets/src/services/SecretService.ts	Passes tenantId into secret creation and audit log creation inputs.
packages/secrets/src/models/SecretAuditLog.ts	Updates createAuditEntry() typing and conditionally includes tenantId in the create input.
packages/secrets/src/tests/secret-service.test.ts	Adds a regression test asserting tenant-scoped audit failures persist even when tenancy interceptor is disabled; ensures tenancy cleanup.
packages/core/src/registry/class-registration.ts	Implements manifest-into-runtime merge logic (fields/methods/schema/config), tenancy normalization/injection, validation rebuild, and inheritance cache invalidation.
packages/core/src/tests/external-runtime-hydration.test.ts	Adds regression coverage for merging manifest schema/fields into an already-registered external runtime class with the same qualified key.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: d952ac3b7c

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".