Feature-gated registry-breg tests run in no CI job

Found in the 0.28.0 pre-release review (2026-09-08). Line references are as of main after #926.

The `breg` CI shard runs `cargo test` with default features (`default = []`), only the `relay-v2` shard passes `--all-features` (`.github/scripts/ci_changes.py:852`), and `products/breg/scripts/test-postgres.sh` lists its test targets explicitly. Tests that need `runtime,tooling` or `schema` and are not on that list therefore never execute in CI:

- `crates/registry-breg/tests/pilot_acceptance_fixtures.rs` (`required-features = ["runtime", "tooling"]`): `asset_placement_change_request_fixture_compiles_site_correction_plan`, `household_change_request_fixture_compiles_contact_registration_plan`, `change_request_pilot_fixture_journeys_preflight_against_their_exact_registries`.
- `crates/registry-breg/tests/action_evidence_compiler.rs::imported_contract_is_sealed_and_rederived` (`runtime,tooling`), which is the `BREG-SEC-41` evidence pin: a security-invariant test CI does not run.
- `crates/registry-breg/tests/action_evidence_compiler.rs::published_authoring_schema_accepts_farmer_v2_and_rejects_unknown_abi` (`schema`).
- `crates/registry-breg/tests/starter_projects.rs::published_starter_journeys_resolve_declared_fields_profiles_and_typed_aliases` (`runtime,tooling`).
- `crates/registry-breg/src/action_evidence_maintenance.rs::malformed_or_future_boundaries_fail_before_configuration_io` (`runtime,tooling`, `--lib`).

Proposed change: run the `breg` shard with the feature set these tests need (or add a `--features runtime,tooling,schema` pass), and add a gate that fails when a `required-features` test target or a `cfg(feature)`-gated test module is selected by no CI invocation, so the list above cannot silently grow again.

Acceptance: each test above appears in a CI log; the gate refuses a newly added gated test that no job selects.

Start with .github/scripts/ci_changes.py:852 and products/breg/scripts/test-postgres.sh to trace the breg CI invocations and explicitly selected targets. Check the listed feature-gated tests in crates/registry-breg/tests and crates/registry-breg/src/action_evidence_maintenance.rs; done means every named test appears in a CI log and the gate rejects a gated test selected by no CI job.

Written by the indexing model from the issue text.