Summary

• Threads context.Context through DataProvider.ReadFile / WalkDir so callers operating against slow/hung backing stores (stalled NFS/sshfs --data mounts) can cancel mid-read.
• Cascades ctx through catalog.LoadWithDataProvider and the validator.ValidatePhases / ValidatePhase entry points called out in the issue acceptance criteria.
• Folds in three doc/code drift fixes left over from chore(recipe): remove back-compat shims introduced by #1107 #1118 (per-provider criteria registry, CLI/server Client model, catalog.Load → catalog.LoadWithDataProvider).

Motivation / Context

Fixes #1109. The pre-existing exposure: a hung NFS / sshfs read on a --data directory would block the validator goroutine until process termination, since the surrounding ValidatePhases(ctx) cancellation couldn't interrupt the in-flight ReadFile. Embedded reads cannot hang; the exposure is narrow but real for network-backed --data mounts.

Type of Change

• New feature (non-breaking change adding functionality)

Components Affected

• Recipes / registry (pkg/recipe)
• Validator (pkg/validator)
• CLI commands (pkg/cli)
• API server (pkg/api)
• Bundler / deployers (pkg/bundler)
• Documentation

Implementation Notes

Interface change. DataProvider.ReadFile(ctx, path) and WalkDir(ctx, root, fn) now take context.Context. Embedded checks ctx.Err() before reading and between entries; Layered forwards ctx to embedded reads and inside mergeEmbeddedAndExternal. The bounded WalkDir(ctx) guard in LayeredDataProvider short-circuits on a stalled network mount.

Catalog entry point. catalog.LoadWithDataProvider(ctx, dp, version, commit) is the new canonical entry; catalog.Load(...) becomes a back-compat wrapper that derives a defaults.FileReadTimeout-bounded context.Background().

Validator propagation. validator.ValidatePhases and ValidatePhase forward their incoming ctx directly to catalog.LoadWithDataProvider so the surrounding --timeout reaches the catalog read.

Public-API back-compat. Existing helpers without ctx in their signature (GetManifestContent, RecipeResult.GetValuesForComponent, HydrateResult) gain *WithContext variants; the no-ctx form derives a bounded context.Background() from defaults.FileReadTimeout internally so a hung mount still returns instead of parking the goroutine. Internal cascades that pass through GetComponentRegistryFor (sync.Once cached, first-load bounded internally) carry //nolint:contextcheck with a rationale comment.

Cancellation test. TestDataProvider_HonorsContextCancellation asserts both implementations return context.Canceled from ReadFile and WalkDir when the caller cancels mid-read.

Drift cleanup (folded in). The user flagged three doc/code references left over from #1118: docs/contributor/data.md still described the criteria registry as process-global (it's per-provider now); pkg/recipe/doc.go still said the CLI/API server uses SetDataProvider (they use aicr.Client with WithRecipeSource); docs/contributor/validator.md referenced the old catalog.Load entry point.

Testing

• go test -race ./... — all packages pass (only pre-existing pkg/trust TUF/Sigstore network test fails in this sandbox; confirmed identical failure on main via git stash).
• golangci-lint run -c .golangci.yaml ./... — 0 issues.
• make qualify — passes except the same pre-existing pkg/trust network test.

Coverage (changed packages)

New test (TestDataProvider_HonorsContextCancellation) covers the four new code paths added in this PR (Embedded.ReadFile + WalkDir ctx checks, Layered.ReadFile + WalkDir ctx checks).

Risk Assessment

Low.

• API change is additive on the call sites where ctx is now required, and the back-compat wrappers (GetManifestContent, Load, HydrateResult, etc.) keep the no-ctx public shape working unchanged for external consumers.
• Internal bounded ctx (defaults.FileReadTimeout) ensures the no-ctx call sites still get a timeout rather than the unbounded blocking that existed before.
• The cancellation test pins the contract.
• Doc-only sections (data.md, validator.md, doc.go) carry no runtime risk.

Checklist

• Tests pass (make test)
• Linter passes (make lint)
• Code follows existing patterns (make qualify)
• Self-review completed
• No Co-Authored-By lines
• Commits are signed (-S)
• PR title ≤ 70 chars

Closes #1109.