Migrate local/path-based dependency resolution from hatch_metadata.json to server.json

[LittleCoinCoin]

Summary

Local / path-based Hatch dependency resolution still reads hatch_metadata.json, which Hatch no longer ships. Since the Hatch CLI migrated package descriptors to the official MCP server.json format, a package that declares a path-based local peer dependency (e.g. ../../basic/base_pkg) fails validation: the resolver looks for a hatch_metadata.json that no longer exists.

This is the dependency-graph / local-dependency analogue of the schema-validation work in #19 — that issue ported schema validation to v2.0.0, but the local-dependency traversal layer was not migrated to server.json.

Root cause / where it lives

name/version always exist at the top level of server.json (official MCP required fields); the Hatch fields live under _meta["io.modelcontextprotocol.registry/publisher-provided"]["io.crackingshells.hatch"]. The validator still resolves local deps from the old single-file format at these sites:

• hatch_validator/utils/hatch_dependency_graph.py:47 — _get_local_dep_pkg_metadata reads path / "hatch_metadata.json". This feeds _add_local_dependency_graph, which calls local_pkg_service.get_field('name') (graph node id / recursion parent) and get_field('version') (→ resolved_version) — so the extracted metadata must carry top-level name/version.
• hatch_validator/package/v1_2_2/dependency_validation.py:331 — _validate_local_dependency checks path / "hatch_metadata.json" and emits "Local dependency '<dep>' missing hatch_metadata.json". Shared verbatim by v1_2_0/dependency_validation.py:240 and v1_1_0/dependency_validation.py:243.
• hatch_validator/package_validator.py:149 — file-loading fallback when metadata= isn't supplied (lower priority — the Hatch CLI always passes metadata= — but should be consistent).
• v2.0.0 needs no new code: it owns only Docker-dep validation and delegates Hatch/Python/System + local-dep handling down to v1.2.2 via the chain of responsibility, so fixing v1.2.2 (+ v1.2.0/v1.1.0) and the graph builder covers it.

Proposed fix

Replace the hardcoded hatch_metadata.json reads with server.json, extracting metadata the same way the Hatch CLI's load_package_metadata does — the extension object under _meta[...]["io.crackingshells.hatch"] plus the top-level name/version merged in — so PackageService.get_field('name') / get_field('version') resolve from the top level.

• server.json-only — no hatch_metadata.json fallback (Hatch no longer emits it).
• Update the error string accordingly.

Note: the dependency name field already permits relative/absolute paths for local packages and imposes no namespace pattern (per the v2.0.0 package schema), so path-based local deps are schema-legal once this read is fixed.

Acceptance criteria

• A local package with a path-based peer dependency and only a server.json (no hatch_metadata.json) passes validate, and its transitive dependency graph builds.
• No remaining reads of hatch_metadata.json on the local-dependency resolution path.

Notes

• Target the dev line toward the next release. Do not alter the pinned hatch-validator==0.9.1 from the Hatch repo, nor change the 0.9.0 branch behavior.
• Companion change: a Hatch-Schemas issue removes the reverse-DNS name pattern (independent of this issue; no landing-order constraint).
• Follow-up once released and the Hatch pin is bumped: revert the simple_dep_pkg test fixture's peer dep from the bare name base_pkg back to its original path form ../../basic/base_pkg.

Surfaced during the server.json migration; see the originating observation report in the Hatch repo (__reports__/resume-status/01-local_dependency_validation_gaps_v0.md).

[LittleCoinCoin]

Companion issue (independent, no landing-order constraint): CrackingShells/Hatch-Schemas#30 — removes the reverse-DNS name pattern from the v2.0.0 package schema.