Support JCB-generated component API contracts while preserving Joomla MCP behavior

[lemuelvdm]

The complete supplied API-enabled JCB package exposed an MCP inventory limit: repeated native form contracts exceeded the 8 MiB worker envelope, and aggregate inventory/revision hashing had the same limit. Current head b52aeb3 uses inventory-only, content-addressed contract sharing and bounded incremental canonical hashing. It preserves every route, method-specific validation rule, JSON type, native source fingerprint, owner and diagnostic. The complete restored inventory fingerprint is verified before database changes. Worker and HTTP/result limits remain 8 MiB; expanded inventory is capped at 64 MiB and 8,192 routes. Catalogue refresh releases its previous decoded graph and all dependent caches before rebuilding, preventing two full form inventories from coexisting. Only a complete new graph is published; failed refreshes cannot use stale definitions or authority. The independently privileged console synchronization branch returns before an unused old-catalogue preload; normal console operations retain their refresh.

The installed golden regression installs the exact supplied 14,597,657-byte JCB ZIP (SHA-256 a5870a1b162c9db1f8c23b87562389c46260838f471914132ef1d3d66fb8f55a). A separate disposable webservices plugin uses that package's actual native compiler renderer because the historical linked plugin was not supplied. It enables all 320 registrations: 318 form-backed routes across 51 forms, including 63 GUID routes, plus two read-only routes. It proves the actual unpadded inventory exceeds the old worker limit, exercises the old output failure and compact success, runs the real installed joomla:mcp:jcb-sync twice, and verifies complete persisted contracts, authenticated discovery, core forwarding and native customization preservation.

Existing scope includes registered GUID/unique-key routes, native forms/subforms, required primary GUID preparation, strict independent readback, bounded nested inputs and native core ownership classification. Actual com_banners/com_contact records with protected=0 and locked=1 retain core ownership. Schema-only administrator customizations retain their effective tool/action/binding restrictions across upgrades; the 130-check before/after suite remains alongside the original 7,786 catalogue checks.

Validation passed: all 32 existing suites plus 43 new inventory transport checks and 23 catalogue refresh checks under a fixed 128 MiB limit; CI verifies 1,876 source-ZIP/relocated-runtime assertions, PHP syntax, Composer validation, locked dependencies and source-pinned seed reproducibility.

All seven checks passed on current head b52aeb3df4cfaa8cd3c3c759fa885a884aab1a8f:

• PHP 8.3/8.4: https://github.com/joomengine/mcp_component/actions/runs/37056971471
• Four installed Joomla PHP/database jobs: https://github.com/joomengine/mcp_component/actions/runs/37056971505
• Installed JCB golden image and full-size supplied API: https://github.com/joomengine/mcp_component/actions/runs/37056971457

Full-size installed acceptance on Joomla 6.1.4 passed 9,589 checks (910 prepare, 4,339 verify, 4,340 rerun). The actual expanded inventory is 8,468,079 bytes and the compact worker output is 3,336,313 bytes. The unchanged legacy worker fails with WORKER_OUTPUT_LIMIT; the compact worker and both real native CLI synchronizations succeed. Every native form contract, all 320 authenticated action discoveries and existing core API forwarding are verified after each sync. The second sync adds/updates/retires no rows, preserves the exact administrator customization, and retains the same revision. Native upgrade (7 checks) and uninstall (29 checks) also pass. No final full-size or container log has a memory fatal. Redacted evidence is retained in the golden workflow artifact installed-jcb-golden-image (artifact ID 11249175806).

Full-size synchronization is distinct from full 51-family native CRUD acceptance and the historical native endpoint failures. No generated API files were edited. All current-head CI is green; this PR remains open and is not merged or released.