refactor: validate generated evidence artifacts

scripts/check-registries.ts

@@ -3,7 +3,6 @@ import {
   mkdir,
   readFile,
   readdir,
-  writeFile,
 } from "node:fs/promises";
 import path from "node:path";
 import { pathToFileURL } from "node:url";
@@ -16,6 +15,8 @@ import {
   verifyRegistryBaselineApproval,
 } from "./lib/registry-compatibility.ts";
 import { assertMatchesJsonSchema } from "./lib/json-schema.ts";
+import { registrySnapshotArtifactSchema } from "./contracts/release-artifacts.ts";
+import { writeValidatedJsonArtifact } from "./lib/validated-json-artifact.ts";
 
 type RegistryRow = Record<string, unknown>;
 type RegistryRows = Record<string, RegistryRow>;
@@ -675,7 +676,11 @@ if (usesRepositoryBaseline && failures.length === 0) {
   }
 }
 await mkdir(path.dirname(artifactPath), { recursive: true });
-await writeFile(artifactPath, `${JSON.stringify(report, null, 2)}\n`);
+await writeValidatedJsonArtifact({
+  path: artifactPath,
+  schema: registrySnapshotArtifactSchema,
+  value: report,
+});
 
 if (failures.length > 0) {
   process.stderr.write(`Registry governance failed:\n${failures.join("\n")}\n`);