feat(cli): add D601 artifact registry planning

Add a first-stage artifact-registry CLI for D601 host-managed CNCF Distribution planning, rendering, dry-run install, and readonly status checks. Document the loopback-only boundary and future backend-core artifact CD flow.\n\nCloses #1.

scripts/src/check.ts

@@ -13,6 +13,7 @@ interface CheckItem {
 const syntaxFiles = [
   "scripts/cli.ts",
   "scripts/src/check.ts",
+  "scripts/src/artifact-registry.ts",
   "scripts/src/code-queue.ts",
   "scripts/src/command.ts",
   "scripts/src/decision-center.ts",
@@ -220,6 +221,7 @@ export function runChecks(config: UniDeskConfig, options: CheckOptions = default
       fileItem("scripts/cli.ts"),
       fileItem("AGENTS.md"),
       fileItem("TEST.md"),
+      fileItem("docs/reference/artifact-registry.md"),
       fileItem("docker-compose.yml"),
       fileItem("src/components/backend-core/Cargo.toml"),
       fileItem("src/components/backend-core/Cargo.lock"),
@@ -234,6 +236,7 @@ export function runChecks(config: UniDeskConfig, options: CheckOptions = default
       fileItem("src/components/microservices/code-queue-mgr/src/index.ts"),
       fileItem("scripts/src/deploy.ts"),
       fileItem("scripts/src/e2e.ts"),
+      fileItem("scripts/src/artifact-registry.ts"),
     );
   } else {
     items.push(skippedItem("files:required-entrypoints", "required file presence scan is opt-in", "--files or --full"));