Migrated from spboyer/waza#388

Summary

Evaluate 4 registry backend options for storing and distributing shared graders and evals. NOT a single JSON file.

Options

1. Go module proxy — repos ARE the registry, each with waza.registry.yaml manifest. No central index.
2. OCI artifacts — grader packages stored in container registries (ghcr.io, ACR). Versioned, signed, immutable.
3. GitHub Releases — versioned tarballs via Releases. Discovery via GitHub Topics (waza-grader).
4. Federated index — multiple registries (org-private + public), like npm scopes or GOPROXY.

Evaluation Criteria

• Enterprise readiness (private repos, air-gapped)
• Versioning and immutability
• Discovery and search
• Implementation complexity
• Ecosystem alignment (Go toolchain, GitHub-native)

Parent: #385