fix: formalize registry discovery bootstrap

[TATP-233]

Summary

• replace scan/import-based registry bootstrap with explicit package-level bootstrap contracts
• add registry bootstrap manifests for env package entrypoints and keep ensure_registries() call sites compatible
• extend tests to cover declared bootstrap contracts, optional-package failures, and invalid contract formats

Validation

• uv run pytest tests/utils/test_algo_utils.py tests/base/test_registry.py tests/config/test_reward_injection.py tests/base/test_reward_override.py -q

Fixes #220