feat(registry): blueprint registry references and access control

**Context:** ROADMAP.md → Blueprint registry references + Registry access control

---

## Component

CDK / infrastructure

## Describe the feature

1. **Blueprint registry references:** `knowledge_tools`, `mcp_servers`, tool profiles reference registry asset IDs + version constraints—not inline definitions. Orchestrator resolves at task start.
2. **Registry access control:** Cedar policies govern publish/deprecate/pin by asset type and namespace. Read (resolve) unrestricted in deployment; write requires operator/publisher role.

## Use case

Asset authoring must decouple from CDK redeploy. Multi-tenant deployments need namespace isolation and publish permissions.

## Proposed solution

1. Extend Blueprint construct schema for `registry_ref` fields.
2. Orchestrator resolution step before agent dispatch (cache per task).
3. Cedar policy pack for registry write actions.
4. Namespaces: `platform/*`, `org/{org_id}/*`.
5. Migration guide from inline blueprint assets.

## Other information

- Child of #246; combines two related roadmap rows.
- Design context: `docs/design/REPO_ONBOARDING.md`, `docs/design/CEDAR_HITL_GATES.md`.

- [x] This might be a breaking change

Inizia da ROADMAP.md e dal contesto di progettazione in docs/design/REPO_ONBOARDING.md e docs/design/CEDAR_HITL_GATES.md. Traccia i punti di ingresso esistenti relativi a Blueprint, orchestrator e registry prima di proporre modifiche allo schema e alle policy. Il lavoro è completo quando i riferimenti al registry, la risoluzione all’avvio del task, i controlli di scrittura Cedar, i namespace e la migrazione degli asset inline sono specificati e coperti.

Scritto dal modello di indicizzazione a partire dal testo della issue.