feat(api): expose authorized Asset release history for delivery clients

[kl3inIT]

Problem

GET /api/asset-delivery returns one AssetSummary per Asset carrying a single releaseId/versionLabel — the current usable release. An older release is still addressable (GET /api/asset-delivery/{assetId}/releases/{releaseId} works if you know the UUID) but not discoverable.

Consequences today:

• MCP completion for release_id (added in feat(mcp): scope completion to authorized Assets and sanitize tool errors #121) can only ever suggest the current release.
• Pinning an agent to an older release — a legitimate governed reproducibility workflow, e.g. an automation validated against v1.2 while current is v1.4 — requires copying a UUID out of the web UI by hand.

Proposal

Add GET /api/asset-delivery/{assetId}/releases returning the releases of one Asset that the current actor may use.

Constraints that must hold:

• same authorization path as the rest of asset-delivery, no second ACL;
• released state only — no draft, no governance/portfolio internals, matching the delivery boundary the asset-registry spec already promises;
• per item: releaseId, versionLabel, releaseDigest, releasedAt, availability;
• deterministic order (newest first).

Then in apps/mcp: extend AssetCompletionAdapter so release_id suggests the full authorized history, and consider a list_asset_releases read-only tool.

Acceptance

• Endpoint implemented with the authorization recheck and the released-only boundary
• contracts/openapi.json regenerated via OpenApiContractTests
• Asset-registry domain spec + test matrix reconciled
• MCP completion suggests historic releases

Notes

Do this before the prompt-coordinate change: that one needs exact version labels, which this endpoint supplies.