feat(registry): blueprint registry references and access control

**Context:** ROADMAP.md → Blueprint registry references + Registry access control

---

## Component

CDK / infrastructure

## Describe the feature

1. **Blueprint registry references:** `knowledge_tools`, `mcp_servers`, tool profiles reference registry asset IDs + version constraints—not inline definitions. Orchestrator resolves at task start.
2. **Registry access control:** Cedar policies govern publish/deprecate/pin by asset type and namespace. Read (resolve) unrestricted in deployment; write requires operator/publisher role.

## Use case

Asset authoring must decouple from CDK redeploy. Multi-tenant deployments need namespace isolation and publish permissions.

## Proposed solution

1. Extend Blueprint construct schema for `registry_ref` fields.
2. Orchestrator resolution step before agent dispatch (cache per task).
3. Cedar policy pack for registry write actions.
4. Namespaces: `platform/*`, `org/{org_id}/*`.
5. Migration guide from inline blueprint assets.

## Other information

- Child of #246; combines two related roadmap rows.
- Design context: `docs/design/REPO_ONBOARDING.md`, `docs/design/CEDAR_HITL_GATES.md`.

- [x] This might be a breaking change

Beginne mit ROADMAP.md und dem Designkontext in docs/design/REPO_ONBOARDING.md und docs/design/CEDAR_HITL_GATES.md. Verfolge die vorhandenen Blueprint-, Orchestrator- und Registry-bezogenen Einstiegspunkte, bevor du Änderungen an Schema und Richtlinien vorschlägst. Als abgeschlossen gilt die Arbeit, wenn die Registry-Referenzen, die Auflösung beim Task-Start, die Cedar-Schreibkontrollen, die Namespaces und die Migration von Inline-Assets spezifiziert und abgedeckt sind.

Vom Indexierungsmodell aus dem Issue-Text verfasst.