Run discovery sync (admin only; dry-run by default)

Runs external-catalog discovery against enabled sources in the owner-approved allowlist. The request is dry-run unless dry_run is false and INTERCHANGE_DISCOVERY_SYNC_ENABLED permits live sync; blocked live attempts return 409. Before selecting or fetching a source, the complete config must pass the source-object, normalized unique-ID, supported-kind, required-field, allowed-URL, and boolean-enabled contract described by /commerce/interchange/admin/sync-sources. Any invalid entry blocks the whole run with failure_code: sources_config_invalid, mode: blocked, and external_calls_made: false; no entry is silently skipped or defaulted. Dry-run performs bounded external catalog GETs only for cadence-due sources, except global_a2a_registry, whose upstream request budget is reserved for live runs and whose dry-run reports source_live_only_bounded_fetch without a GET. Dry-run updates allowlisted source registration metadata and writes an audit event, but imports or refreshes no resource rows, calls no provider, spends nothing, and mutates no listing or trust state. Name-only edits preserve prior live proof. A same-ID kind or URL change invalidates that proof and marks prior source resources stale even in dry-run, requiring a successful live sync under the new definition. Each source kind requires its explicit catalog list shape; a legitimate empty list succeeds, while an ambiguous HTTP-200 object is a source error. MCP normalization accepts legacy flat entries and current {server, _meta} Registry wrappers; it retains only bounded names, descriptions, and the first safe credential-free HTTPS remote endpoint while discarding wrapper metadata, package configuration, headers, and credential material. Global A2A Registry live attempts are reserved before network I/O, pinned to the observed GET https://api.a2a-registry.org/public/agents?limit=20 request, capped at one request per 24 hours, raw and decompressed 128 KiB response limits, and a 50-record parser ceiling, and retain only sanitized provenance/discovery/trap-scan evidence in durable Interchange events. Because the public limit=20 behavior is observed rather than formally documented, responses with 20 or more agents are partial even when their declared total equals the returned page; missing or malformed totals are partial and totals below the returned page are rejected. Every Global A2A record remains provenance-only: it never infers contact, invoke, trust, routing, referral, provider, or money authority. Partial responses refresh seen rows without marking unseen prior rows absent. These metadata-only cards are excluded from the x402 Router bridge candidate query before its SQL limit. Every successful live fetch/normalize run assigns a durable per-source run token. Complete source snapshots mark prior rows absent from that exact run stale, including after a successful empty catalog; bounded partial snapshots do not. Fetch, shape, normalization, or persistence errors return no successful run ID, preserve absent prior rows/tokens and last-successful proof, skip exact-absence finalization, and record a non-ok source status. Scheduled looping is separately owner-gated. Every caller shares a synchronous execution claim before PostgreSQL pool checkout plus a session advisory execution lease; overlapping admin, CLI, canary, Cartographer, dry-run, and scheduled calls return mode=blocked before fetch or definition/finalization writes. Scheduled runs additionally hold a distinct session advisory leader lock so only one horizontally scaled timer leads. Standalone CLI/canary entrypoints run pending migrations before sync-table access; the discovery CLI sends migration progress to stderr so stdout remains one JSON report. Stale enabled sources, an absent/dry-run loop, a non-PostgreSQL leader guard, a blocked most-recent scheduled execution, or a scheduler error are surfaced through /api/commerce/interchange and /api/health. Retained stale history alone does not alarm, and synced cards never become eligible for invocation binding.