feat(registry): blueprint registry references and access control

**Context:** ROADMAP.md → Blueprint registry references + Registry access control

---

## Component

CDK / infrastructure

## Describe the feature

1. **Blueprint registry references:** `knowledge_tools`, `mcp_servers`, tool profiles reference registry asset IDs + version constraints—not inline definitions. Orchestrator resolves at task start.
2. **Registry access control:** Cedar policies govern publish/deprecate/pin by asset type and namespace. Read (resolve) unrestricted in deployment; write requires operator/publisher role.

## Use case

Asset authoring must decouple from CDK redeploy. Multi-tenant deployments need namespace isolation and publish permissions.

## Proposed solution

1. Extend Blueprint construct schema for `registry_ref` fields.
2. Orchestrator resolution step before agent dispatch (cache per task).
3. Cedar policy pack for registry write actions.
4. Namespaces: `platform/*`, `org/{org_id}/*`.
5. Migration guide from inline blueprint assets.

## Other information

- Child of #246; combines two related roadmap rows.
- Design context: `docs/design/REPO_ONBOARDING.md`, `docs/design/CEDAR_HITL_GATES.md`.

- [x] This might be a breaking change

Start with ROADMAP.md and the design context in docs/design/REPO_ONBOARDING.md and docs/design/CEDAR_HITL_GATES.md. Trace the existing Blueprint, orchestrator, and registry-related entry points before proposing the schema and policy changes. Done means the registry references, task-start resolution, Cedar write controls, namespaces, and inline-asset migration are specified and covered.

Written by the indexing model from the issue text.