Discovery sync sources and status (admin only)

Returns configured allowlist sources, synced source state, scheduler state, freshness alarms, and current-versus-historical resource counts. Readiness is scoped to source IDs currently enabled in the owner-reviewed allowlist. Every enabled source must exist, be active, have last_sync_status=ok, have a sync timestamp within the stale threshold, and have at least one fresh non-stale resource. Historical/quarantined rows and rows outside the enabled source set remain visible but do not alarm by themselves. Current counts are exposed as external_resources, stale_resources, blocked_historical_resources, and resources_past_stale_threshold; all-row history is exposed separately as historical_external_resources, historical_stale_resources, and resources_outside_enabled_sources. Live sync is disabled by default through INTERCHANGE_DISCOVERY_SYNC_ENABLED. The recurring loop is separately owner-gated through INTERCHANGE_DISCOVERY_SYNC_SCHEDULER_ENABLED. Scheduler status includes tick_in_flight for the synchronous pre-checkout overlap guard. The top-level execution_guard is a distinct all-caller boundary: scheduler, admin, CLI, canary, Cartographer projection, and dry-run definition writes share a synchronous process claim and PostgreSQL session advisory execution lease. Per-source sync reports expose durable run IDs, exact-run absence-stale counts, and source-definition invalidations. The recurring loop must stay off in production until the PostgreSQL advisory-lock leader guard is deployed and the descriptor reports leader_guard.kind=postgres_advisory_lock with available=true. The owner-reviewed JSON config is validated as one unit before any outbound call: sources must be an array; every entry must be a non-null, non-array object with a required normalized ID unique after normalization, a non-empty name, a supported kind (x402_index, mcp_registry, manual_export, a2a_card, or global_a2a_registry), an allowed credential-free HTTP(S) url (HTTPS in deployed runtime; http://127.0.0.1 only in tests), and a strictly boolean enabled value. Optional min_sync_interval_ms must be an integer from 900000 through 518400000. The six-day upper bound leaves a full-day margin before the seven-day resource-staleness threshold. The shared runner enforces it before any fetch across scheduled, admin, CLI, canary, and dry-run callers; a not-yet-due source reports skipped: true, skip_reason: source_minimum_interval_not_elapsed, and next_eligible_at without making an external call or replacing live proof. These are the source-definition fields for every current kind. One invalid entry fails the whole config as the bounded sources_config_invalid error instead of being skipped or defaulted.