fix: close comprehensive 0.23 Registry audit

[a19q3]

Summary

• Harden Registry publish metadata, source hashing, and reverse-proxy request identity boundaries.
• Bind verifier output to the exact signed dependency set and reject local path or Git dependency injection.
• Update Registry API dependencies, migration coverage, CI action pinning, and Dependabot configuration.
• Advance the website submodule to fix: harden Registry links and website build chain cellscript-website#1.
• Record the comprehensive 0.23 audit closure in the changelog, release notes, and roadmap.

Validation

• ./scripts/cellscript_gate.sh ci passed.
• Registry API: 69 tests with PostgreSQL.
• Registry verifier: 8 tests.
• Website clean install and full build passed.
• Whitespace and source-policy checks passed.

Remaining upstream advisories

• Registry API: 3 low-severity JoyID or elliptic transitive advisories.
• Website: 20 low-severity CKB connector or elliptic transitive advisories.