feat(#918): loop.render-hooks resolver — consume the Capability Registry (ADR-857 phase 3c) (#920)

Add the loop.render-hooks resolver: the first registry-consuming query.
`gsd-tools loop render-hooks <point>` validates the point against the
authoritative canonical 12, reads the registry's materialized byLoopPoint
hooks, filters them by activation, and emits a JSON envelope {point,
activeHooks, rendered} with ordered markdown.

Activation resolves each hook's `when` key by precedence: loadConfig value
(post-cutover federated) -> raw config.json workstream/root single-key lookup
(pre-cutover central override) -> registry configSchema default (so a
default:true capability hook is active out-of-the-box) -> inactive. Guarded
single-value reads only (no merged object built from untrusted keys).

Registry-only: no workflow calls the resolver yet (wiring is the phase-6
cutover). Completes the phase-3 trio.

Closes #918

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

docs/INVENTORY-MANIFEST.json

@@ -309,6 +309,7 @@
       "learnings.cjs",
       "legacy-cleanup.cjs",
       "loop-host-contract.cjs",
+      "loop-resolver.cjs",
       "milestone.cjs",
       "model-catalog.cjs",
       "model-profiles.cjs",