chore: sync Registry Stack identifiers to the v0.33.0 release source

[jeremi]

Rebind the publisher bundle to the exact Registry Stack v0.33.0 release source commit.

The release publication dispatch fails closed unless src/upstream/source.json
names the exact released source commit and identifier catalog digest. The
previous sync (#8) pinned 125f67b37. Main has since advanced through
registry-stack #1317 (release builds no longer embed the source commit) and
#1318 (advisory baselines rebound to the resulting images), and the candidate
is bound to 1f6facb57e9d142652019e8065dc093fc9f0dd12.

Regenerated with:

npm run import:catalog -- ../registry-stack \
  --source-revision 1f6facb57e9d142652019e8065dc093fc9f0dd12
npm run build

What changed

Only the source-commit binding. The identifier catalog is byte-identical:

• catalog_sha256 stays 800de6c787568677a26e2ccf4b0bc0fb5aaada4ac51e044a1b956b27fa3a1748
• 160 active identifiers, 178 preserved historical identifiers, both unchanged
• every one of the 619 changed lines in 311 files is a commit-SHA reference;
  after normalising the old and new SHA, every removed line equals an added line

Verification

• npm run check:upstream against a checkout of 1f6facb57: in sync, 160 active, 178 historical preserved
• npm test passes (exit 0), including check:problem-routes

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.