fix(registry): one-time setRegistry on GRUAssetRegistryFacet (GRU-005).

Prevent post-init registry pointer swaps; add test_setRegistry_oneTimeOnly (8/8 GRUCompliantTokensRegistryTest).

Co-authored-by: Cursor <cursoragent@cursor.com>

contracts/registry/GRUAssetRegistryFacet.sol

@@ -13,8 +13,9 @@ contract GRUAssetRegistryFacet {
 
     event RegistrySet(address indexed registry);
 
-    /// @notice Set the UniversalAssetRegistry to delegate to. Call from Diamond cut init (only Diamond owner can execute cut).
+    /// @notice One-time set of UniversalAssetRegistry delegate. Callable once (diamond cut init or standalone deploy).
     function setRegistry(address _registry) external {
+        require(address(registry) == address(0), "RegistryAlreadySet");
         require(_registry != address(0), "Zero registry");
         registry = UniversalAssetRegistry(_registry);
         emit RegistrySet(_registry);

test/integration/GRUCompliantTokensRegistry.t.sol

@@ -53,6 +53,13 @@ contract GRUCompliantTokensRegistryTest is Test {
         vm.stopPrank();
     }
 
+    function test_setRegistry_oneTimeOnly() public {
+        GRUAssetRegistryFacet localFacet = new GRUAssetRegistryFacet();
+        localFacet.setRegistry(address(registry));
+        vm.expectRevert("RegistryAlreadySet");
+        localFacet.setRegistry(makeAddr("otherRegistry"));
+    }
+
     function test_registerGRUCompliantAsset_cUSDT() public {
         vm.prank(admin);
         registry.registerGRUCompliantAsset(