AVM v13 relaxes box isolation: an app can opt its boxes into reads by any other
app. Both registries now do that in a new createApplication, which runs
app_params_set(appForeignBoxReads, true). Verified on localnet that the opcode is
permitted during the creating call itself, so no separate post-create step is
needed - the v13 notes describe enabling access as update-then-run, but that is
for apps already deployed.

Reads only; writes stay exclusive to the owning app. app_params_set is run by an
app on itself, so a contract that is not updatable can never opt in later, which
is what preserves intentional immutability.

The create is a real ABI method rather than a bare one. It lands in the ARC-56 and
the generated clients, it can take arguments later without changing the create
shape a second time, and it matches the house style - FracDelegationInstance
already has an ABI createApplication invoked by selector from the registry
factory. Both createRegistry paths switch from create.bare() to the method call;
every other caller routes through createRegistry.

Two consequences of the create no longer being bare, both found by the suite:

- deployRegistryWithoutBytecode in the period e2e spec deploys a registry
  directly and was still doing a bare create, which is no longer routed and fails
  with an err on the OnCompletion match.

- The ATST unit specs. ATST holds a contract with any create method in
  `isCreating` and rejects every ABI call with "method can not be called while
  creating" until a create method runs - but ATST 1.2.0 predates v13 and cannot
  execute app_params_set, so the real body cannot run in the emulator. The
  registry test subclass overrides createApplication with a no-op and calls it
  after construction; the opt-in itself is covered e2e.

Follow-up worth taking: with foreign reads on, much of the registries' readonly
getter and log-dumping surface (getDelegation, getPeriodSummary, logCommitteePages,
getEscrow, ...) exists only because cross-app box reads used to be impossible.
Not touched here.

Suite green: 539 passed (2 new).

This will fail CI until
https://github.com/algorand/algorand-sdk-testing/pull/327 is merged

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

Should ideally merge
https://github.com/algorand/algorand-sdk-testing/pull/327 first so we
can continue to use master

fix(ci): validate SDK-dependent projects after the SDKs are built

The committee-uploader and frac-delegation-pipeline validate steps ran
immediately after `pnpm install --ignore-scripts`, but both link to
ggov-sdk / frac-delegation-sdk, whose `dist/` is gitignored and only
produced by the later "Build SDKs" step. Their typecheck (and the
pipeline's test run) therefore resolved against SDK builds that did not
exist yet.

Move both steps below "Build SDKs" so their dependencies are present.