fix(frontend): name a catalog policy only for components it blocks (#14681)

The editor decided a node was "disabled by an administrator" from
catalog_governance_enabled, a single flag meaning "some policy exists".
That cannot answer a per-component question. `blocked` only means "no
template for this type", which is equally an uninstalled bundle, a flow
imported from another install, or a component the user wrote themselves,
and the flag is true when *either* blocklist is non-empty -- so blocking
one starter template was enough to brand every such node, refuse its
build, and pause autosave on work the server would have accepted.

The frontend was never given what it needed to answer the question, so
the server now sends it: /config reports the blocked component identities
to authenticated callers, resolved through the same alias index the
enforcement path uses. The banner, the build preflight and the autosave
pause each ask whether the policy names *this* component.

The identities go to authenticated callers only. The public response
still withholds the policy contents, and they reveal nothing the palette
does not already -- these are exactly the components withheld from /all.
A node carrying some third alias of a blocked component is not named and
the editor stays quiet, which under-claims rather than over-claims; the
server still refuses the run.

Drops catalogPolicyCanBlock and its cold-registry heuristic: an explicit
identity set is unambiguous, so "the registry has not loaded yet" no
longer needs guessing at.

Reported by QA as LE-2226 BUG-01 against #14614.