Extend RegisteredDataStore with upstream storage

[philbrookes]

Summary

• Adds RegisteredUpstreamKey, RegisteredUpstreamEntry, and TargetRef types to RegisteredDataStore for storing registered upstream configurations per policy
• Implements full CRUD methods (SetUpstream, GetUpstream, GetAllUpstreams, GetUpstreamsByTargetRef, DeleteUpstream) with concurrency-safe locking
• Extends ClearPolicyData to also clean up registered upstreams when a policy is removed
• Updates manager.go to handle the new return value and trigger notifications on upstream changes
• Marks Extend RegisteredDataStore with upstream storage #1790 as complete in the design doc and adds issue links to remaining TODOs

Review and local verification

# Run the upstream storage unit tests
make test-unit TEST_NAME=TestRegisteredDataStore

# Run all extension package tests
go test -tags unit ./internal/extension/ -v

Verify:

• All existing RegisteredDataStore tests still pass (ClearPolicyData callers updated from 2 to 3 return values)
• New upstream CRUD operations work correctly
• GetUpstreamsByTargetRef filters entries by target reference
• Concurrent upstream operations are safe (tested with 10 goroutines)
• Edge cases handled: empty store, non-existent keys, overwrite

Closes #1790

🤖 Generated with Claude Code