Register a small external repo as a tenant so pull-mode ingestion has a cheap proof subject

Problem

Pull-mode tenant ingestion has never been proven end to end, and the tenant bootstrap makes proving it expensive.

ai/deploy/kb-config.yaml registers exactly one tenant repo: neo-shared/neo — the maintainer checkout's own corpus, 23,952 tracked files. Two consequences:

1. The only available proof subject is the most expensive one. On a blobless mirror a cold content read costs ~0.42 s/file (#16557), so a first ingest of neo is a multi-hour operation. Every attempt to answer "does pull-mode ingestion work at all" pays that.
2. No genuinely external repo is registered, so the lane's actual purpose — pulling content the plane does not already have — is unexercised. kbSync already owns the neo corpus, and both lanes are now container-plane (kbSync moved via #16556), so the one registered tenant duplicates a corpus rather than adding one.

Measured state: lastIngestedRev = null on every configured repo, checkpointStatus = uninitialized, and repoSlug counts in neo-knowledge-base are neo=59158 with every other slug at 0 — where those 59,158 come from kbSync, not from tenant ingestion.

Proposal

Register neomjs/create-app as a second repo under the existing neo-shared tenant. Small, public, and external to the maintainer checkout — the cheap end-to-end proof subject, answering in minutes rather than hours.

Verified against the remote before proposing: create-app is public, and its only branch is main — it has no dev. So branchRef must be main, not inherited from the sibling neo entry's dev. Copying the sibling would have produced a clone failure.

Acceptance criteria

• neo-shared/create-app present in the tracked bootstrap with credentialRef: none and branchRef: main.
• The bootstrap contract spec pins both entries, including that their branchRef values differ deliberately.
• Repo identity uniqueness (tenantId/repoSlug) asserted — the chunk id is sha256({tenantId, repoSlug, hash, type, name, source}), so a duplicate pair would silently merge two repos into one identity namespace.
• tenantCount stays 1 — a second repo under one tenant, not a second tenant.

Out of scope

• The embed-stage failure — #16566. Registration alone will not make ingestion succeed; KB_VECTOR_EMBED_FAILED still blocks it. This removes the cost obstacle to proving it, not the defect.
• Whether neo-shared/neo should remain a tenant entry at all (#16566 question 1).
• First-ingest round-trip cost on a cold mirror — #16557.

Why a separate ticket

#16566's proof AC needs a subject that is cheap to ingest repeatedly. Landing that subject is mechanically independent of root-causing the embed failure, so doing it separately means the proof run is ready the moment the embed fix lands.

Related

• #16566 — the embed-stage blocker; this makes its proof AC affordable.
• #16557 — why tracked-file count dominates first-ingest cost.
• #16556 — moved kbSync to the container plane, which is why both lanes now share one.

Authored by @neo-opus-vega (Claude Opus 5).