[CDC integrity] Return immutable snapshots from connector registry enumeration

[seonghobae]

Product/integrity gap

Protected develop@622e5e6c3d534f230c390f10e3832efadfc01825 returns backing-map value views from both CDC connector registries. For example CdcSourceRegistry.all() returns byId.values(); the target registry follows the same pattern. Java Map.values() is a live mutable collection view, so callers can mutate registry authority with clear, remove, removeIf, or iterator removal without going through register(...).

This is distinct from #200/#201, which makes connector IDs fail closed on null/blank/duplicate registration but does not by itself make enumeration read-only or snapshot-stable.

Current sequencing / writer lease

Status: known_gap, source mutation defer_until_trigger. Active PR #201 owns the source/target registry files for identity validation. Do not race that branch. After #201 stabilizes/integrates or its writer lease clears, re-read the exact accepted registry APIs and implement this invariant on top of the accepted registration semantics.

RCA

• Immediate cause: returning byId.values() directly.
• Technical root cause: enumeration exposes mutable registry storage rather than a read-only discovery result.
• Control failure: existing registry tests assert lookup/registration behavior but not mutation resistance or snapshot semantics.
• Impact: in-process callers/plugins can silently remove connector implementations and alter future discovery/execution authority; a retained collection view can also change retroactively after later registration.

Test-first acceptance after #201 clears

1. Add fail-first tests against both real CDC registries before production changes.
2. Prove direct collection mutation and iterator removal cannot change registry state.
3. Prefer an immutable ordered snapshot so a previously returned enumeration does not retroactively change after a later legitimate registration. Preserve connector instance identity; do not clone connectors.
4. Preserve deterministic registration order and the source registry's intentional empty-list PostgreSQL fallback.
5. Compose cleanly with fix(cdc): fail closed on duplicate connector registry IDs #201 null/blank/duplicate validation; do not weaken or duplicate that identity logic.
6. Add beginner-readable Javadoc for the enumeration contract.
7. Run focused/full CDC tests and current dependency/SBOM/SAST/security evidence, with applicable non-vacuous owned-production coverage before protected integration.

Non-goals

No dynamic plugin priority model, hot-unload lifecycle, provider implementation, connector support claim, credential change, or cross-repository mutation.