fix: guard corrupted registry entries and make manifest authoritative

- Add isinstance(meta, dict) guard in bash registry parsing so corrupted
  entries are skipped instead of breaking priority ordering
- Only use convention-based file lookup when the manifest does not list
  the requested template, making preset.yml authoritative and preventing
  stray on-disk files from creating unintended layers

Author: mnriem

scripts/bash/common.sh

@@ -320,8 +320,8 @@ try:
     with open(os.environ['SPECKIT_REGISTRY']) as f:
         data = json.load(f)
     presets = data.get('presets', {})
-    for pid, meta in sorted(presets.items(), key=lambda x: x[1].get('priority', 10)):
-        if meta.get('enabled', True) is not False:
+    for pid, meta in sorted(presets.items(), key=lambda x: x[1].get('priority', 10) if isinstance(x[1], dict) else 10):
+        if isinstance(meta, dict) and meta.get('enabled', True) is not False:
             print(pid)
 except Exception:
     sys.exit(1)
@@ -408,8 +408,8 @@ try:
     with open(os.environ['SPECKIT_REGISTRY']) as f:
         data = json.load(f)
     presets = data.get('presets', {})
-    for pid, meta in sorted(presets.items(), key=lambda x: x[1].get('priority', 10)):
-        if meta.get('enabled', True) is not False:
+    for pid, meta in sorted(presets.items(), key=lambda x: x[1].get('priority', 10) if isinstance(x[1], dict) else 10):
+        if isinstance(meta, dict) and meta.get('enabled', True) is not False:
             print(pid)
 except Exception:
     sys.exit(1)

src/specify_cli/presets.py

@@ -2701,6 +2701,7 @@ def _find_in_subdirs(base_dir: Path) -> Optional[Path]:
                 strategy = "replace"
                 manifest_file_path = None
                 manifest_has_strategy = False
+                manifest_found_entry = False
                 manifest = self._get_manifest(pack_dir)
                 if manifest:
                     for tmpl in manifest.templates:
@@ -2709,16 +2710,20 @@ def _find_in_subdirs(base_dir: Path) -> Optional[Path]:
                             strategy = tmpl.get("strategy", "replace")
                             manifest_has_strategy = "strategy" in tmpl
                             manifest_file_path = tmpl.get("file")
+                            manifest_found_entry = True
                             break
-                # Use manifest file path if specified, otherwise convention-based lookup
+                # Use manifest file path if specified, otherwise convention-based
+                # lookup — but only when the manifest doesn't exist or doesn't
+                # list this template, so preset.yml stays authoritative.
                 candidate = None
                 if manifest_file_path:
                     manifest_candidate = pack_dir / manifest_file_path
                     if manifest_candidate.exists():
                         candidate = manifest_candidate
                     # Explicit file path that doesn't exist: skip convention
                     # fallback to avoid masking typos or picking up unintended files.
-                elif candidate is None:
+                elif not manifest_found_entry:
+                    # Manifest doesn't list this template — check convention paths
                     candidate = _find_in_subdirs(pack_dir)
                 if candidate:
                     # Legacy fallback: if manifest doesn't explicitly declare a