registry: bootstrap synth-coverage guard is blind to nested-stack resources (#664 B4)

**Source:** blocking finding B4 from @scottschreckengaust's review of #664 — https://github.com/aws-samples/sample-autonomous-cloud-coding-agents/pull/664#pullrequestreview-4916211565
**Parent:** #246

## Problem
`cdk/test/bootstrap/synth-coverage.test.ts` asserts over `Template.fromStack(root AgentStack)`. #664 introduced two nested stacks (`AgentRegistryStack`, `RegistryApi`), and a nested stack's resources **do not appear in the parent template** — the parent only carries an `AWS::CloudFormation::Stack`. So the guard that exists to prevent #350's failure mode (deploy dies at CFN with `AccessDenied` on an unmapped resource type) now provides **zero** coverage for the resource types that moved into the nested stacks:

- `AWS::StepFunctions::StateMachine`
- `AWS::Cognito::UserPoolGroup`
- `Custom::AgentCoreRegistry`
- the second `AWS::ApiGateway::*` surface
- `AWS::Logs::LogGroup`

## Not a live deploy bug
The shipped bootstrap bundle is **correct today** — every CFN type in both nested stacks is mapped in `RESOURCE_ACTION_MAP` / `CFN_TYPES_WITHOUT_EXEC_ROLE_IAM` and granted in the policy documents, `BOOTSTRAP_VERSION` is a correct minor bump to 1.5.0, artifacts + `DEPLOYMENT_ROLES.md` golden baseline are updated. This is a **test-coverage regression**, not a policy gap: a *future* unmapped type added to a nested stack would deploy-fail with no local guard catching it.

## Fix
Extend `synth-coverage.test.ts` to also synthesize and walk each nested stack's own template (`Template.fromStack(nestedStack)`), so every resource type across the root + nested stacks is covered by the bootstrap-IAM guard.

## Acceptance
- synth-coverage asserts over root + both nested-stack templates
- a deliberately-unmapped resource type in a nested stack fails the test

Beginne mit cdk/test/bootstrap/synth-coverage.test.ts und untersuche, wie es Template.fromStack(root AgentStack) synthetisiert. Erweitere den Test so, dass er auch die Templates von AgentRegistryStack und RegistryApi synthetisiert und durchläuft. Erledigt ist es, wenn die Templates von root und beiden verschachtelten Stacks abgedeckt sind und ein absichtlich nicht zugeordneter Ressourcentyp in einem verschachtelten Stack den Test fehlschlagen lässt.

Vom Indexierungsmodell aus dem Issue-Text verfasst.