Publish a signed kernel manifest + PTX text

FEATURE-GATED: this route is only mounted when the gateway is built with --features kernel-registry-api; the default build does not register it (request 404s at the router). When the feature is on but TENSOR_WASM_API_KERNEL_HMAC_KEY is unset the handler returns 503 kernel_registry_not_configured.

Publishes a signed KernelManifest plus its PTX source. The registry re-verifies that BLAKE3(ptx_text) matches manifest.digest and that the manifest's HMAC-SHA256 signature verifies under the server's configured key before persisting.

Authorization is stricter than the other routes: in addition to bearer_auth + tenant_scope, the caller's bearer token must appear in the TENSOR_WASM_API_KERNEL_PUBLISH_TOKENS allowlist (the kernel-publish scope). Dev mode (empty TENSOR_WASM_API_TOKENS) rejects every publish with 403 kernel_publish_disabled_in_dev_mode. See crates/tensor-wasm-api/src/kernels.rs.