feat(registry): blueprint registry references and access control

**Context:** ROADMAP.md → Blueprint registry references + Registry access control

---

## Component

CDK / infrastructure

## Describe the feature

1. **Blueprint registry references:** `knowledge_tools`, `mcp_servers`, tool profiles reference registry asset IDs + version constraints—not inline definitions. Orchestrator resolves at task start.
2. **Registry access control:** Cedar policies govern publish/deprecate/pin by asset type and namespace. Read (resolve) unrestricted in deployment; write requires operator/publisher role.

## Use case

Asset authoring must decouple from CDK redeploy. Multi-tenant deployments need namespace isolation and publish permissions.

## Proposed solution

1. Extend Blueprint construct schema for `registry_ref` fields.
2. Orchestrator resolution step before agent dispatch (cache per task).
3. Cedar policy pack for registry write actions.
4. Namespaces: `platform/*`, `org/{org_id}/*`.
5. Migration guide from inline blueprint assets.

## Other information

- Child of #246; combines two related roadmap rows.
- Design context: `docs/design/REPO_ONBOARDING.md`, `docs/design/CEDAR_HITL_GATES.md`.

- [x] This might be a breaking change

ROADMAP.md と docs/design/REPO_ONBOARDING.md および docs/design/CEDAR_HITL_GATES.md の設計コンテキストから始めます。スキーマとポリシーの変更を提案する前に、既存の Blueprint、orchestrator、registry 関連のエントリポイントを追跡します。registry の参照、task-start の解決、Cedar の書き込み制御、namespace、inline-asset の移行が仕様化され、カバーされていれば完了です。

索引モデルが issue の本文から書いたものです。