Provide CRM-owned functions for portal registration

Context

Registration needs constrained access to contact matching and creation across the ownership boundary.

Decision

Platform registration reaches candidate selection and declined-suggestion creation through CRM-owned security-definer functions granted to the Platform application role.

Alternatives Considered

Call a separate CRM HTTP operation. This adds another request boundary to registration.

Let Platform create CRM contacts directly. Record writes would cross the owning application boundary.

Consequences

The SQL matching port has comparisons with the TypeScript scorer in CRM tests. Portal matching does not consult workspace rules or their stored portal flag.