registry: bootstrap synth-coverage guard is blind to nested-stack resources (#664 B4)

[Kalindi-Dev]

Source: blocking finding B4 from @scottschreckengaust's review of #664 — #664 (review)
Parent: #246

Problem

cdk/test/bootstrap/synth-coverage.test.ts asserts over Template.fromStack(root AgentStack). #664 introduced two nested stacks (AgentRegistryStack, RegistryApi), and a nested stack's resources do not appear in the parent template — the parent only carries an AWS::CloudFormation::Stack. So the guard that exists to prevent #350's failure mode (deploy dies at CFN with AccessDenied on an unmapped resource type) now provides zero coverage for the resource types that moved into the nested stacks:

• AWS::StepFunctions::StateMachine
• AWS::Cognito::UserPoolGroup
• Custom::AgentCoreRegistry
• the second AWS::ApiGateway::* surface
• AWS::Logs::LogGroup

Not a live deploy bug

The shipped bootstrap bundle is correct today — every CFN type in both nested stacks is mapped in RESOURCE_ACTION_MAP / CFN_TYPES_WITHOUT_EXEC_ROLE_IAM and granted in the policy documents, BOOTSTRAP_VERSION is a correct minor bump to 1.5.0, artifacts + DEPLOYMENT_ROLES.md golden baseline are updated. This is a test-coverage regression, not a policy gap: a future unmapped type added to a nested stack would deploy-fail with no local guard catching it.

Fix

Extend synth-coverage.test.ts to also synthesize and walk each nested stack's own template (Template.fromStack(nestedStack)), so every resource type across the root + nested stacks is covered by the bootstrap-IAM guard.

Acceptance

• synth-coverage asserts over root + both nested-stack templates
• a deliberately-unmapped resource type in a nested stack fails the test