feat(registry): expose atomic provenanced snapshot state

[wolfy-j]

Why

Registry ownership is registry state, not author-controlled entry metadata. A consumer that combines an entry scan with repeated live provenance lookups can cross registry versions during install, update, rollback, or dynamic uninstall.

What

• Define the registry-owned ProvenancedSnapshotReader capability for atomic current and historical state reads; the system registry implements it for every storage/history driver.
• Add snapshot:state() returning detached { entries, provenance } values captured at one registry version.
• Key provenance by canonical entry ID, require a total map, and filter entries and provenance through the same registry.get authorization boundary.
• Fail closed for invalid provenance and overlays that do not carry provenance.
• Keep registry.find() metadata-only; it does not combine finder output with a separate live provenance read.
• Complete the Lua manifest using the existing EntryProvenance and ProvenancedState vocabulary.
• Require entry-read permission for the existing point provenance API.
• Migrate application dependency lifecycle tests to the atomic snapshot without a meta.module fallback, covering install, update, rollback, forward apply, root preservation, and uninstall.
• Make the application runner fail instead of succeeding when it discovers zero tests.

No storage schema, entry payload, Hub, dependency, or metadata format changes.

Verification

• go test -race -count=1 ./api/registry ./runtime/lua/modules/registry ./system/registry/...
• golangci-lint on the registry API, system, and Lua packages
• Application harness load and lifecycle coverage for current, historical, overlay, root, and module ownership behavior