feat: support Registry v3 package transport

[jamesdoh0109]

Summary

• build canonical Registry-v3 packages with exact skill identities, versions, and digests
• keep the existing push, pull, and apply surfaces; add no top-level command
• support exact skill pulls with telos pull skill @scope/name:version
• create new package and skill identities privately by default, with explicit telos push --public
• verify package and skill bundles before materialization
• preserve exact deployment revision materialization across runtime updates and visibility changes

Design boundary

Registry v3 is transport and integrity plumbing, not a new CLI product surface. Discovery and visibility management stay in the hosted product. The CLI retains its existing package-oriented workflow:

telos push SPEC.md|SKILL_DIR [--public]
telos pull @scope/name:version [--output PATH]
telos pull skill @scope/name:version [--output DIR]
telos apply @scope/name:version

Canonical v3 packages reference exact Registry skills instead of copying their files. Hydration validates identity, version, digest, compressed size, expanded size, entries, paths, and file types before mutating the workspace.

Verification

• go test ./...
• bazel test //... (16/16 test targets passed)
• git diff --check

Dependencies

Requires the companion Cloud Registry privacy API and capability contract. This PR does not migrate the Registry catalogue or change production configuration.