registry: bootstrap synth-coverage guard is blind to nested-stack resources (#664 B4)

**Source:** blocking finding B4 from @scottschreckengaust's review of #664 — https://github.com/aws-samples/sample-autonomous-cloud-coding-agents/pull/664#pullrequestreview-4916211565
**Parent:** #246

## Problem
`cdk/test/bootstrap/synth-coverage.test.ts` asserts over `Template.fromStack(root AgentStack)`. #664 introduced two nested stacks (`AgentRegistryStack`, `RegistryApi`), and a nested stack's resources **do not appear in the parent template** — the parent only carries an `AWS::CloudFormation::Stack`. So the guard that exists to prevent #350's failure mode (deploy dies at CFN with `AccessDenied` on an unmapped resource type) now provides **zero** coverage for the resource types that moved into the nested stacks:

- `AWS::StepFunctions::StateMachine`
- `AWS::Cognito::UserPoolGroup`
- `Custom::AgentCoreRegistry`
- the second `AWS::ApiGateway::*` surface
- `AWS::Logs::LogGroup`

## Not a live deploy bug
The shipped bootstrap bundle is **correct today** — every CFN type in both nested stacks is mapped in `RESOURCE_ACTION_MAP` / `CFN_TYPES_WITHOUT_EXEC_ROLE_IAM` and granted in the policy documents, `BOOTSTRAP_VERSION` is a correct minor bump to 1.5.0, artifacts + `DEPLOYMENT_ROLES.md` golden baseline are updated. This is a **test-coverage regression**, not a policy gap: a *future* unmapped type added to a nested stack would deploy-fail with no local guard catching it.

## Fix
Extend `synth-coverage.test.ts` to also synthesize and walk each nested stack's own template (`Template.fromStack(nestedStack)`), so every resource type across the root + nested stacks is covered by the bootstrap-IAM guard.

## Acceptance
- synth-coverage asserts over root + both nested-stack templates
- a deliberately-unmapped resource type in a nested stack fails the test

Inizia da cdk/test/bootstrap/synth-coverage.test.ts e analizza come sintetizza Template.fromStack(root AgentStack). Estendi il test in modo che sintetizzi e attraversi anche i template di AgentRegistryStack e RegistryApi. Il lavoro è completo quando sono coperti i template di root e di entrambi gli stack annidati e un tipo di risorsa deliberatamente non mappato in uno stack annidato fa fallire il test.

Scritto dal modello di indicizzazione a partire dal testo della issue.