fix(gateway): reduce plugin registry lock duration during load/unload - #25

…livery (#883)

## Linked Issue

Closes #882

## Summary

The publish/subscribe **ACL authorization** used the strict
`topic::topic_matches` (a `*` is exactly one segment) while event
**delivery** uses `astrid_events::TopicMatcher` (a trailing `*` is a
subtree wildcard — one or more segments at any depth). That divergence
forced capsule manifests to enumerate wildcard depth
(`astrid.v1.admin.*` / `*.*` / `*.*.*`) just to authorize publishing
topics whose depth varies or is unknown (uuid suffixes, variable
sub-paths), and it's the same matcher asymmetry that made the cli
run-loop crash confusing. This authorizes via the route-layer matcher so
a declared trailing `*` covers the whole subtree, and makes
`TopicMatcher::matches_topic` the single source of truth shared by
delivery and ACL — they can never silently diverge again.

## Changes

- `astrid-events`: extract `TopicMatcher::matches_topic(&str)` from the
existing subtree logic; `matches(&event)` delegates to it. Added a
direct subtree test.
- `astrid-capsule`: the two ACL checks (`publish_inner`,
`check_subscribe_acl`) authorize via
`TopicMatcher::new(pattern).matches_topic(topic)` instead of strict
`topic_matches`.
- Scope: only the two ACL sites change. Interceptor dispatch
(`dispatcher.rs`) keeps strict `topic_matches`; the runtime "wildcard
must be terminal" subscribe gate is unchanged.

Permissive change — authorizes more, denies nothing previously allowed;
delivery was already subtree, so nothing that worked stops working.
Adversarial pass: ACL is per-capsule declared intent (no
cross-principal/escalation path); no match-all hole (a bare `*` stays
single-segment; only `prefix.*` is subtree-under-prefix); subscribe
pattern-vs-pattern is sound (a broad ACL authorizes a narrower request,
an exact ACL does not authorize a broader wildcard request). Breadth is
the operator's decision at install (the manifest declares intent;
capabilities + install review are the boundary).

## Test Plan

### Automated

- [x] `cargo test --workspace` passes
- [x] No new clippy warnings

`cargo test -p astrid-events` (matcher, incl. new
`matches_topic_subtree_for_acl`) and `-p astrid-capsule --lib` (ACL /
topic / audit-scope) — green, no regressions.

### Manual

Rebuilt the daemon, collapsed the cli manifest to `astrid.v1.request.*`
+ `astrid.v1.admin.*` (dropping the depth enumeration and the mcp
front-door exacts), reinstalled. `astrid agent list` (a 6-segment
`astrid.v1.admin.response.agent.list` round-trip) and `astrid mcp serve`
`tools/list` (8 tools, a 6-segment `astrid.v1.request.mcp.tools.list`
publish) both work — authorized by the single subtree patterns.

Follow-up (separate, capsule-cli): collapse the cli manifest once this
lands — it currently enumerates depth + lists the mcp exacts
(capsule-cli #25) because it must work against today's strict kernel.

## Checklist

- [x] Linked to an issue
- [x] CHANGELOG.md updated under `[Unreleased]`