Centralize changelog/bundle S3 key construction and validation

[cotti]

Why

The S3/CDN key shapes — bundle/{product}/... and changelog/{org}/{repo}/{branch}/... — and their per-segment validation rules were hand-rolled independently in five places: the upload producer, the scrubber Lambda's pass-through gate, the registry builder, and both CDN fetchers. Each re-derived prefixes, segment counts, and allowed character classes on its own, so the layout and its validation could silently drift apart as they evolve.

Closes elastic/docs-eng-team#637.

What

Adds ChangelogKeys (in Elastic.Documentation.Configuration/ReleaseNotes, the dependency-graph common ancestor) as the single source of truth for the layout: per-position segment validators, key construction, group extraction, CDN path segments, and the scrubber's IsRegistry gate. The producer, scrubber Lambda, registry builder, and both CDN fetchers now consume it; RegistryKey and the producer's three inline regexes are removed.

Unifying the rules also tightens two consumers to match what the producer enforces on upload (nothing the producer accepts is newly rejected):

• The scrubber gate now applies the GitHub-login rule to the org segment (no dots/underscores) instead of a uniform allow-dots class.
• CdnChangelogFetcher gained product validation it previously lacked — the new test demonstrates a .. product would otherwise normalize the registry URI outside the bundle/ layout.

Covered by 128 new test cases (all RegistryKeyTests cases ported and extended); verified with the full unit suite, CI lint, the CLI schema check, and an AOT publishbinaries run plus a smoke test of the published binary.

🤖 Generated with Claude Code