feat(registry): blueprint registry references and access control

**Context:** ROADMAP.md → Blueprint registry references + Registry access control

---

## Component

CDK / infrastructure

## Describe the feature

1. **Blueprint registry references:** `knowledge_tools`, `mcp_servers`, tool profiles reference registry asset IDs + version constraints—not inline definitions. Orchestrator resolves at task start.
2. **Registry access control:** Cedar policies govern publish/deprecate/pin by asset type and namespace. Read (resolve) unrestricted in deployment; write requires operator/publisher role.

## Use case

Asset authoring must decouple from CDK redeploy. Multi-tenant deployments need namespace isolation and publish permissions.

## Proposed solution

1. Extend Blueprint construct schema for `registry_ref` fields.
2. Orchestrator resolution step before agent dispatch (cache per task).
3. Cedar policy pack for registry write actions.
4. Namespaces: `platform/*`, `org/{org_id}/*`.
5. Migration guide from inline blueprint assets.

## Other information

- Child of #246; combines two related roadmap rows.
- Design context: `docs/design/REPO_ONBOARDING.md`, `docs/design/CEDAR_HITL_GATES.md`.

- [x] This might be a breaking change

Empieza con ROADMAP.md y el contexto de diseño en docs/design/REPO_ONBOARDING.md y docs/design/CEDAR_HITL_GATES.md. Rastrea los puntos de entrada existentes relacionados con Blueprint, el orquestador y el registro antes de proponer cambios en el esquema y las políticas. Se considera terminado cuando las referencias del registro, la resolución al iniciar la tarea, los controles de escritura de Cedar, los espacios de nombres y la migración de activos inline estén especificados y cubiertos.

Escrito por el modelo de indexación a partir del texto del issue.