Stop the provider registry from publishing unreleased providers (#76109)

The registry's release-tag filter never ran in CI: breeze ran
extract_metadata.py inside a container with no .git, so git found no tags
and the script fell back to every version in provider.yaml. A live build
on 2026-09-29 published common-dataquality 0.1.0, which was never released.

extract_metadata.py now runs on the host, where the tags are visible, and
skips providers with state: not-ready. A live registry build fails if the
checkout has no providers-* tags; local runs without tags still warn and
keep every version.

registry/README.md

@@ -103,6 +103,10 @@ gitignored. Only `exploreCategories.js`, `statsData.js`, `latestVersionData.js`,
 **`extract_metadata.py`** (runs on host) walks every `providers/*/provider.yaml` and:
 
 1. **Parses provider metadata** — name, description, versions, dependencies
+   - **Drops unreleased entries** — skips providers with `state: not-ready` and keeps only
+     versions with a `providers-<id>/<version>` git tag. With no tags at all (a fork clone),
+     it warns and keeps every version; `registry-build.yml` refuses a live build in that case.
+     `--allow-unreleased` turns the filter off.
 2. **Fetches PyPI download stats** — calls `pypistats.org/api/packages/{name}/recent`
 3. **Resolves logos** — checks `public/logos/` for matching images
 4. **Determines AIP-95 lifecycle stage** — reads `lifecycle` from `provider.yaml`