Registry, approvals and audit

The registry holds canonical package and workspace desired state, with content stored as registry objects addressed by their sha256 hash. `wl push --draft` creates a draft package version from selected package assets; it is never an upload of a workspace folder.

A registry admin approves package versions (a package approval, recorded with the actor’s name), and the audit log records who did what to which package or workspace, and whether it was allowed. SSO groups map to principal roles (admin, reader, service), with a wildcard mapping for identities that carry no groups.