Close HUB-WP-0009 conformance gaps (C2, C7, C9, C10); mark blocked workplans

Implements the four residual conformance checks left open by the T04
minimal vertical:

- C2: GET /ports/registry/registrations/{hub_slug} resolves missing (404),
  ambiguous (shared reuse_surface_id across hub_slugs), and stale
  (deprecated/retired descriptor) registrations; a new .../audit route
  exposes queryable registration history from the existing in-memory
  history and the PostgreSQL runtime_audit_ledger.
- C7: harness proof that disabled compatibility groups deny access
  (404) with no fixture credentials involved, matching the existing
  fail-closed compat router behavior.
- C9: harness proof plus a dedicated test that /readyz degrades only on
  an unavailable configured dependency while unrelated disabled
  projections stay non-blocking.
- C10: ContractValidator now negotiates contract_version_min/max against
  the runtime's contract version and rejects incompatible or inverted
  ranges with an explicit 422 instead of silently accepting them.

HUB-WP-0009 is now finished. HUB-WP-0006 is marked blocked: its only open
task (T06) has no remaining hub-core code path and waits on an external
Forgejo identity/production deployment gate. HUB-WP-0011 is marked
blocked: T02/T03 already waited on external credential/deployment
review, and T01 needs a source/destination ownership and retention
decision against live message data before it can be implemented safely.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: sonnet
Assistant-Process: 310936@bnt-lap001
Assistant-Session: 00cd9abe-09a0-416b-88e0-f907b9101629

hub_core/runtime/ports.py

@@ -47,6 +47,36 @@ def create_ports_router() -> APIRouter:
             raise HTTPException(status_code=422, detail=str(exc)) from exc
         return await store.register_extension(body, x_correlation_id)
 
+    @router.get(
+        "/registry/registrations/{hub_slug}",
+        response_model=PortRecord,
+        tags=["registry"],
+        openapi_extra={"x-port-id": "port.registry", "x-direction": "out"},
+    )
+    async def resolve_registration(
+        hub_slug: str,
+        store: PortStore = Depends(get_port_store),
+    ) -> PortRecord:
+        resolved = await store.resolve_registration(hub_slug)
+        if resolved is None:
+            raise HTTPException(status_code=404, detail=f"Registration '{hub_slug}' not found")
+        return resolved
+
+    @router.get(
+        "/registry/registrations/{hub_slug}/audit",
+        response_model=PortCollection,
+        tags=["registry"],
+        openapi_extra={"x-port-id": "port.registry", "x-direction": "out"},
+    )
+    async def registration_audit(
+        hub_slug: str,
+        store: PortStore = Depends(get_port_store),
+    ) -> PortCollection:
+        audit = await store.list_registration_audit(hub_slug)
+        if not audit.items:
+            raise HTTPException(status_code=404, detail=f"No audit history for '{hub_slug}'")
+        return audit
+
     @router.get(
         "/messaging/messages",
         response_model=PortCollection,