Rework domain create/update mutation logic for container registry associations

## Description

Update the domain create/update write path so that registry associations are written to the ASE table and to the legacy `domains.allowed_docker_registries` ARRAY column atomically (dual-write).

## Behavior

- Inputs to `DomainCreatorSpec` and `DomainNodeUpdaterSpec` carry registry UUIDs (`list[UUID]`). Callers that only have names (gql_legacy) resolve them to UUIDs at the API boundary before invoking the spec.
- For the resolved UUID set: (1) sync ASE rows via the `ContainerRegistryDomainEntityUnbinder` plus `RBACScopeBinder`; (2) write the corresponding registry names into the ARRAY column for backward read fallback.
- Name resolution policy (used by gql_legacy resolver): a name that matches multiple registries fans out to all matching UUIDs, preserving current ambiguous-name behavior without server crash.
- Domain delete / purge removes the related ASE rows via the unbinder.

## Success Criteria

- After create or update, ASE rows and the ARRAY column are in lockstep.
- Ambiguous-name input expands to all matching UUIDs in ASE; ARRAY keeps the names exactly as supplied.
- Domain delete cleans up all related ASE rows; no FK or orphan rows remain.
- pants test passes.

JIRA Issue: BA-6087