perf(brand-assets): add generated brand asset cache manifest

[JSONbored]

Summary

Brand assets are resolved at request time through the brand asset route. A generated cache manifest would reduce repeated upstream dependency on Brandfetch, improve Raycast/list rendering performance, and make failures more deterministic.

Current state

• /api/brand-assets/[kind]/[domain] validates domains and proxies trusted Brandfetch asset hosts.
• Registry artifacts can already include brand fields such as brandDomain, brandIconUrl, brandLogoUrl, and brandAssetSource.
• There is no generated manifest of known brand asset resolutions and fallback state.

Desired behavior

• Generate a brand asset cache manifest during content/artifact generation.
• Prefer known generated asset URLs where available.
• Retain the live route as fallback for missing or refreshed brands.
• Make failures visible in validation or quality reports.

Implementation notes

• Build on packages/registry/src/brand-assets.js and existing brand enrichment scripts.
• Do not embed third-party secrets or client IDs in artifacts.
• Keep cache entries bounded to public, validated domains.

Acceptance criteria

• Generated manifest lists known brand domains and resolved safe asset URLs/status.
• Raycast/registry artifacts can use generated URLs when available.
• Live route remains safe and bounded.
• Tests cover trusted host enforcement, missing asset fallback, and manifest shape.

Validation

• pnpm validate:content:strict
• pnpm test:registry-artifacts
• pnpm exec vitest run tests/api-router-security.test.ts
• Add or update focused unit tests for the touched API/helper surface.
• Run the narrow relevant validation command for the changed package or route.
• Run git diff --check before opening a PR.