feat(registry): asset versioning and immutability

**Context:** ROADMAP.md → Asset versioning and immutability

---

## Component

CDK / infrastructure

## Describe the feature

Every registry asset version is **immutable** once published. Blueprints pin versions explicitly (**no floating `latest` in production**). Version resolution follows **semver constraints**. Rollback is **re-pin to prior version**, not mutation.

Enables reproducible agent executions and safe rollout without affecting **running tasks**.

**Asset kinds** (parent #246): skills, plugins, MCP servers, capabilities (verification strategies, knowledge tools), prompt fragments, Cedar policy modules.

## Use case

Reproducible agent runs and safe rollout of new tool versions without affecting in-flight tasks require immutable version artifacts.

## Proposed solution

1. S3 object versioning + write-once metadata in DynamoDB registry table.
2. Publish API rejects overwrites for existing `(asset_id, version)`.
3. Blueprint schema: `asset_ref@^1.2.0` pin semantics.
4. Task start resolves to concrete version; record on task record.
5. Tests: publish, resolve, re-pin rollback.

## Other information

- Child of #246 central asset registry epic.
- Design context: `docs/design/ARCHITECTURE.md` (registry section when added).

- [ ] This might be a breaking change

Start with ROADMAP.md and the registry section of docs/design/ARCHITECTURE.md, then review parent issue #246 for the asset-registry boundaries. Use the proposed publish, resolve, and re-pin rollback tests as the acceptance path; done means published versions cannot be overwritten, blueprint references resolve semver constraints to concrete versions, rollbacks re-pin prior versions, and task records preserve the resolved version.

Written by the indexing model from the issue text.