Artifact Registry closed beta rollout: align feature-flag scoping with the onboarding unit (organizations)

Summary

We onboard closed-beta customers per organization, but the gating flags don't match that unit: two are user-scoped, one is org-scoped (ChatOps/API tooling for org actors exists since July 2026 but is undocumented, see item 5 below).

Onboarding therefore needs either per-user ChatOps commands for every customer engineer (a set that goes stale as their owners change) or global enables. On staging we ended up enabling everything globally. A missed per-user flag surfaces as masked 404s that look like service bugs, which happened repeatedly during testing this week.

Current landscape

Flag	Actor	Owner	Gates
artifact_registry_ui	organization	Artifact Registry	the org's AR UI (introduced in !244109 (merged))
artifact_registry_role_assignment	user	Authentication	role grant/revoke/list GraphQL (!241285 (merged))
gate_token_exchange_endpoint	user	Authentication	POST /api/v4/token_exchange (!236798 (merged))
ui_for_organizations	user	Organizations	the entire /o/ UI all AR pages live under

Proposal (updated 2026-09-03 after input from Authentication and Organizations)

Flags should gate beta membership (org-shaped); authorization already gates who can do what. This converges on a single org-scoped flag:

1. gate_token_exchange_endpoint: removed by Authentication in !253385 (merged). Must land before the closed beta launch.
2. artifact_registry_role_assignment: Authentication will remove it as well (see discussion). The removal also un-gates the owner-role sync workers from !250806 (merged).
3. ui_for_organizations: superseded by Organizations' imminent self-service opt-in GA (see discussion).
4. artifact_registry_ui: the single remaining closed beta flag, org-scoped, matching the onboarding unit. Removed at open beta, when gating moves entirely to org onboarding.
5. Implement organization actor support in the Features API and ChatOps Already shipped (2026-07-01, !243125 (merged) + !243147 (merged), and gitlab-com/chatops!721 (merged)): /chatops run feature set --organization=<id-or-path> artifact_registry_ui true. The remaining gap is documentation: doc/development/feature_flags/controls.md never mentions the organization actor, which is how this issue initially assumed it did not exist. Follow-up: update that page.