Requiring a shipped operation serves it, with no way to load without registering

Requiring a shipped operation's file registers it. A cell that only wants a subclass of that operation still advertises and serves the parent.

`HotCell::Operation.inherited` calls `Registry.register` for every subclass, unconditionally. So `require "active_storage/hot_cell/server/previewers/video/ffmpeg"` puts `active_storage.previewers.video.ffmpeg` in the cell's inventory whether or not anything should reach it, and a client that names it gets served.

The BC4 install hit this while subclassing the two media operations to insert ffmpeg gates. Their workaround is to call `abstract_operation` on the shipped class after requiring it. That works, because `abstract_operation` is not inherited and `Registry.reload!` drops the parent, but it reaches into a class the application does not own and depends on that method's exact semantics.

Wanted: a supported way to load an operation without serving it, or to subclass without the parent registering. Two shapes worth weighing:

- A require-time switch that loads a file for its classes and registers nothing, leaving the subclass to register on its own.
- A registry allowlist in `config.rb`, so a cell serves exactly the names it lists and everything else it loaded stays dark.

The second is more than this asks for, but it is also what "load only the operations your image has tools for" in `README-active-storage.md` is trying to achieve by controlling requires, and an explicit list would make that mechanical.

Smaller now than when it was raised: with 41be17d4 the two media operations take input arguments from the application, so BC4 no longer needs the subclasses that surfaced this. It remains real for anyone subclassing a shipped operation for another reason.

Start by tracing HotCell::Operation.inherited and Registry.register, then inspect Registry.reload! and abstract_operation to understand the current registration behavior. Read active_storage/hot_cell/server/previewers/video/ffmpeg, config.rb, and README-active-storage.md. Done means providing a supported way to load or subclass a shipped operation without serving the parent, with behavior covered by the project’s existing checks.

Written by the indexing model from the issue text.