pub const REGISTRY_FILE: &str = "registry.yaml";
repo_id → sandbox repo path + enrolled remote ids. Daemon writes, agent reads.
repo_id