[2026 Registry] Add authentication and abuse controls to publish APIs

[Nanle-code]

Objective

Authenticate publishers, rate-limit mutations, and retain auditable ownership history.

Target area

registry-api publish routes

Acceptance criteria

• The objective is implemented with clear handling for invalid input, unsupported environments, and failure paths.
• Automated tests cover the primary flow, at least one boundary case, and at least one failure case.
• User-facing documentation or developer guidance is updated, including compatibility, security, or migration notes where applicable.

Source: .github/roadmap-issues-2026-07-29.json.