test(infra): verify-registerrecord asserts RegisterRecord objecttype registered + published (refs #141)

Fails against a stack with Objecttypen up but no objecttype seeded yet:
"no objecttype named 'RegisterRecord'". Green comes with the seeded
registerrecord-init one-shot in the next commit.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

infra/run-registerrecord-check.sh

@@ -0,0 +1,28 @@
+#!/usr/bin/env bash
+#
+# S-18c (#141): assert the RegisterRecord objecttype is registered + published in the Objecttypen
+# API, against an ALREADY-RUNNING stack. Runs the check in a python:3-slim container on the stack
+# network (the service is reached by container IP; the runner can't reach published ports —
+# gitea-actions-gotchas.md §5/§6). Does NOT manage the stack lifecycle.
+set -euo pipefail
+
+here="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+
+# The dev token provisioned by infra/objecttypen/setup_configuration/data.yaml.
+TOKEN="${OBJECTTYPEN_TOKEN:-0123456789abcdef0123456789abcdef01234567}"
+
+ot="$(docker ps -q --filter 'name=objecttypen' --filter 'health=healthy' | head -1)"
+[ -n "$ot" ] || ot="$(docker ps -q --filter 'name=[-_]objecttypen[-_]' | head -1)"
+[ -n "$ot" ] || { echo "ERROR: no running objecttypen container — bring the stack up first" >&2; exit 1; }
+net="$(docker inspect -f '{{range $k,$_ := .NetworkSettings.Networks}}{{$k}}{{"\n"}}{{end}}' "$ot" | head -1)"
+ip="$(docker inspect -f '{{range .NetworkSettings.Networks}}{{.IPAddress}}{{end}}' "$ot")"
+echo ">> network=$net objecttypen=$ip"
+
+cid="$(docker create --network "$net" \
+  -e "OBJECTTYPEN=http://$ip:8000" -e "OBJECTTYPEN_TOKEN=$TOKEN" \
+  -e "REGISTERRECORD_TIMEOUT=${REGISTERRECORD_TIMEOUT:-60}" \
+  python:3-slim python /registerrecord-check.py)"
+docker cp "$here/registerrecord-check.py" "$cid:/registerrecord-check.py" >/dev/null
+rc=0; docker start -a "$cid" || rc=$?
+docker rm -f "$cid" >/dev/null
+exit $rc