fix: account for TECH_LOG_STUDIO_SESSION in the auth profile registry pin

Task 3's contract contribution legitimately registered a TECH_LOG_STUDIO_SESSION
auth profile, growing INSTALLED_REST_AUTH_PROFILES from 2 to 3 entries. The
exact-key-set regression test at contract-registry-immutability.test.ts:91
correctly caught the drift; test:unit was left off Task 3's verification list,
so it went unnoticed until Task 5 ran the full suite. Updates the expected key
list rather than weakening the assertion, so it keeps forcing a reviewer to
confirm any future registry change was intended.

tests/unit/contract-registry-immutability.test.ts

@@ -91,6 +91,7 @@ describe("LIVE-02 installed REST auth profile registry", () => {
     expect([...registry.keys()].sort()).toEqual([
       "ANONYMOUS",
       "REFERENCE_EXTERNAL_BEARER",
+      "TECH_LOG_STUDIO_SESSION",
     ]);
     expect([...registry.entries()].length).toBe(registry.size);
     expect([...registry.values()].length).toBe(registry.size);