releases json validate <domain> — live fetch + materialization plan (part 2 of #351)

[zachdunn]

Part 2 of #351. Part 1 (local-path / stdin schema validation) shipped in #352; this issue tracks the remaining domain form.

Idea

releases json validate <domain> — fetch https://{domain}/.well-known/releases.json, validate it live, and render the materialization plan (which org identity / products / sources would be created, and at which tier), so an owner iterating on a hosted manifest gets the same "check my work" verdict the web fast-lane shows.

The <target> argument surface already accommodates this: a domain-looking argument is detected today and exits with code 2 plus a pointer here, so adding the domain form is additive — no breaking change to part 1.

Blocked on

buildinternet/releases#1910 — the public, rate-limited dry-run endpoint keyed by domain.

Per the constraint in that issue, the domain form must share the same validation backend as the web fast-lane so web and CLI never disagree on verdicts, and so the CLI renders the same plan object the web preview does. Part 1 deliberately did not fabricate a client-side domain verdict for this reason.

Scope when unblocked

• Replace the deferral branch in src/cli/commands/json.ts (looksLikeDomain → the "not available yet" notice) with a call to the public dry-run endpoint.
• Render the returned plan: org identity fills, product declarations, and source creations grouped by tier (Tier-1 auto vs. Tier-2 needs-review), mirroring the web preview.
• --json passes the raw plan object through for machine consumers.
• Preserve part-1 exit-code semantics (0 valid / 1 invalid) and the local-path/stdin path unchanged.
• Tests: live-fetch verdict + plan rendering (mock the endpoint), and web/CLI verdict-parity coverage.

Notes

• Read-only → stays a top-level verb, not under admin.
• Reuses the existing ReleasesJsonConfigSchema for the schema half; the endpoint owns the plan half.
• Prior art referenced in releases json validate [path|domain] — v2 manifest owner tooling #351 / Fast-lane submission: live releases.json verification + self-serve activation releases#1910: integrations.sh's activation loop.