Closes #722 (and does a bit more). In that issue we were specifically concerned with splitting REGISTRY into read/write effects, so it's more obvious when a function is only reading from the registry and not modifying it. However, along the way, I noticed that we don't need the GITHUB effect in the read handler either, so I went ahead and removed it. I did a little overall audit through the codebase to make sure each function is using the least effects required to get the job done.

Some basic notes on what was done:

• split the Registry effect into REGISTRY_READ and REGISTRY_WRITE, while retaining REGISTRY as a convenience alias for workflows that need both
• give Registry reads a handler that emits only LOG + AFF + EFFECT; only the write handler retains GITHUB
• audit production, server, script, E2E, and test effect rows so each path receives the minimum Registry responsibility it needs
• remove transitive GitHub credentials, Octokit clients, caches, and interpreters from PackageSetUpdater, VerifyIntegrity, and the real Registry read-handler test
• preserve the shared Registry environment, memory cache, debouncer, pull machinery, and existing publication/retry behavior