feat: support read-only external references across ct projects

[bwl21]

Closes #143

Summary

• add state v2 external bindings with in-memory v1 migration and globally unique logical keys
• add generic registry-backed ct use, ct unuse, state listing/removal/rekeying, and live hard-identity validation
• resolve external resources read-only across hierarchy, dynamic rulesets, permissions, and other logical reference positions without admitting them to apply or destroy inputs
• add structured blocking diagnostics and ct ownership check for explicit cross-project coordination scopes
• document the ownership model, CLI workflow, identity contract, and all supported resource types

Verification

• npm test -- --reporter=dot — 1141 passed, 5 skipped
• npm run typecheck
• npm run lint
• npm run format:check
• npm run build
• node .github/scripts/docs-staleness.mjs