Complete registry security and canonical Key publication

[stakach]

Closes #7.

Scope

• Captures the effective registry subject, previous mode, token references, descriptor assignment and audit decision. Existing-Key OPEN and parent CREATE use separate access checks, including generic access mapping, WOW64 masking and BACKUP_RESTORE.
• Uses canonical PM reserved Key handles for hosted callers, drivers, win32k and the System kernel-handle table. RootDirectory targets and CM OPEN results remain owned through nested validation; unpublished handles are released only by their exact dispatch owner.
• Keeps SYSTEM volatile Keys under CM identity. Volatile edits affect the live generation but do not enter the durable hive log or image.
• Retains native SYSTEM CREATE through BEGIN, durable storage, COMMIT, target OPEN, publication and ACK. Hosted and provider callers hold their original Reply and process/thread ownership through cancellation and uncertain effects. Provider bootstrap resumes acknowledged autonomous services and retries a failed Free query without resending the Reply.
• Removes superseded private/tagged Key paths and the old SYSTEM create path.

Verification

• Focused suites: nt-security 230, nt-process 290, nt-user-host 785, nt-fs 240 unit + 2 doc, nt-config-client 183, nt-config-manager 39, nt-config-server 125, nt-hive-core 111 unit + 18 image tests, nt-component-suspension 385 unit + 14 doc tests. The combined CM run also passed 21 client doc tests.
• Native executive release build passes on final code at d4b97df.
• Full crate CI passes on d4b97df3.
• Two bounded headless boots built the full disk image and passed bootstrap wait (timed-call=1 unrelated=1 hardware-wake=1 exact-ack=1) and shared ingress (providers=2 workers=3 nested=1 retired=3). Both stopped at the strict win32k import registry: 27 unresolved imports. The last boot image preceded the final one-line tombstone fix, which passed the native release build. There is no desktop proof in this PR; Close the 27 strict win32k imports with real NT mechanisms #17 owns the import gate.

Review

• Independent ownership review covered exact CM lease and RootDirectory identity, parent-create versus target-open policy, subject references, invisible PM slots, uncertain COMMIT/ACK, caller termination, Reply acknowledgement and physical retirement. Findings on relative SYSTEM creation, OPEN ownership across nested IPC, autonomous wait resumption and stopped wait tombstones were fixed in this PR.
• Complete durable CM COMMIT/ACK and storage barriers #8 retains the broader one-shot SYSTEM set/delete/security mutation wrapper and full power-loss recovery work. This PR implements its durable continuation dependency for secured native Key creation only.