Clarify or support constant CEL expressions in attribute-release profiles

[jeremi]

Context

PR #488 validates CEL authority from parsed AST roots. A constant expression has no authority root, so the current exactly-source rule rejects it with the general kind=authority configuration diagnostic. This is safe, but opaque, and it excludes constant booleans or scalar computed claims without an explicit product decision.

Scope

• Decide whether an empty authority-root set is valid for attribute-release predicates and computed claims.
• If constants are allowed, accept them while continuing to reject context and all roots other than source.
• If constants remain prohibited, provide a specific configuration diagnostic and document the reason.
• Keep Registry Relay and Registryctl authoring validation in parity.
• Add focused parser, validation, and authoring tests.

Related: #487, #488.