feat(registry): asset versioning and immutability

**Context:** ROADMAP.md → Asset versioning and immutability

---

## Component

CDK / infrastructure

## Describe the feature

Every registry asset version is **immutable** once published. Blueprints pin versions explicitly (**no floating `latest` in production**). Version resolution follows **semver constraints**. Rollback is **re-pin to prior version**, not mutation.

Enables reproducible agent executions and safe rollout without affecting **running tasks**.

**Asset kinds** (parent #246): skills, plugins, MCP servers, capabilities (verification strategies, knowledge tools), prompt fragments, Cedar policy modules.

## Use case

Reproducible agent runs and safe rollout of new tool versions without affecting in-flight tasks require immutable version artifacts.

## Proposed solution

1. S3 object versioning + write-once metadata in DynamoDB registry table.
2. Publish API rejects overwrites for existing `(asset_id, version)`.
3. Blueprint schema: `asset_ref@^1.2.0` pin semantics.
4. Task start resolves to concrete version; record on task record.
5. Tests: publish, resolve, re-pin rollback.

## Other information

- Child of #246 central asset registry epic.
- Design context: `docs/design/ARCHITECTURE.md` (registry section when added).

- [ ] This might be a breaking change

Inizia da ROADMAP.md e dalla sezione registry di docs/design/ARCHITECTURE.md, quindi esamina l’issue principale #246 per i confini dell’asset-registry. Usa i test di rollback proposti per publish, resolve e re-pin come percorso di accettazione; completato significa che le versioni pubblicate non possono essere sovrascritte, i riferimenti ai blueprint risolvono i vincoli semver in versioni concrete, i rollback fissano nuovamente le versioni precedenti e i record delle attività conservano la versione risolta.

Scritto dal modello di indicizzazione a partire dal testo della issue.