feat: set up preview versions monitoring and preview registry for JetBrains

[EugeneTheDev]

What & why

Adds an opt-in preview channel so JetBrains IDEs can ship newer, unstable ACP wrapper builds (starting with codex-acp and claude-acp) without affecting the public registries.

An agent may now declare an optional preview block in its agent.json holding exactly version + distribution. The build emits a third, self-contained index dist/registry-for-jetbrains-preview.json in which a previewed agent appears as an ordinary entry — same id and metadata, with version/distribution substituted from the preview block and the preview key stripped. Agents without a preview block appear there at their stable version, so the file is a drop-in replacement for registry-for-jetbrains.json.

"preview": {
  "version": "1.9.0-preview.1",
  "distribution": {
    "npx": { "package": "@agentclientprotocol/codex-acp@1.9.0-preview.1" }
  }
}

Key design decisions

• Version scheme X.Y.Z-preview.N — valid semver; 1.9.0-preview.N ranks below 1.9.0, and preview.10 correctly outranks preview.2 (numeric prerelease identifiers).
• Highest of both channels wins. preview.version means "the newest version we know about", so it may legitimately hold a plain X.Y.Z release. A stale preview is not an error: the hourly checker writes max(highest published preview, highest published stable), and the build falls back to the stable entry when stable is ahead. No build failure, no downgrade for preview users.
• Preview is deliberately unverified. Preview distributions are never launched (verify_agents.py and protocol_matrix.py stay stable-only), their URLs are never probed, and no new CI jobs are added. The only preview-specific check is offline: the package spec's pinned version must equal preview.version. Speed and simplicity over safety on an explicitly unstable channel.
• npx/uvx only — binary preview distributions are rejected by the schema.

Changes

Schema & manifests

• agent.schema.json: anchored the root version pattern (a prerelease can no longer leak into the stable field); added the previewChannel definition (required: version + distribution, additionalProperties: false, npx/uvx reusing packageDistribution).
• Seeded preview blocks for codex-acp and claude-acp.

Build

• registry_utils.py: PREVIEW_VERSION_RE, parse_preview_version, is_preview_version, semver_sort_key, version_tuple/normalize_release_version (hoisted from the checker), strip_preview, and resolve_preview_entry — the single definition of "what a preview entry is", shared by all scripts.
• build_registry.py: offline validate_preview; both public registries mapped through strip_preview; third output written, with a build summary listing which ids are actually ahead of stable; optional registry_dir argument for testability.
• build-registry.yml: new file added to the release assets (S3 aws s3 sync dist/ needs no change).

Hourly version updates

• update_versions.py: VersionUpdate.channel; fetch_distribution_versions with a per-agent source cache so both channels share one fetch per source; get_highest_preview_version; check_agent_preview_version; channel-branching apply_update; channel in the --json payload and a new --channels filter. The dist-tags.latest fallback remains stable-only.
• update-versions.yml: staging map re-keyed path → {channel → version} (a path-only key let one channel mask the other) and asserted against the right field per channel; auth verification filtered to stable ids and skipped when empty; channel rendered in commit messages.

Docs & tooling

• Documented the channel in FORMAT.md, AGENTS.md, README.md, including the new CDN path and the wrapper-repo prerequisite (npm publish --tag preview — publishing a prerelease without it moves dist-tags.latest onto it).
• Added --with jsonschema to both test runners: schema validation was silently skipped in every test run before this.