Registry org create/update carries too many responsibilities #1925

Evidence:

• src/repositories/baseOrgRepository.js:615-982 handles registry/legacy conversion, UUID generation, role discriminator selection, review object creation, audit creation, legacy write, filtering, and output shape.
• The same file has comments indicating known fragility around legacy write behavior at src/repositories/baseOrgRepository.js:750-754.

Impact:

• Hard to change one responsibility without affecting the others.
• Audit behavior is duplicated between inline code and helper functions.
• Role/discriminator changes are especially risky because delete/recreate behavior is embedded in the update path.