Cancel in-progress partition reassignments via AlterPartitionAssignments
with null replicas, reverting each partition to its prior replica set.
Requires explicit topic:partitions; does not cancel everything at once.
Also drops a dead empty-if in alter.

New 'kcl registry' command space over franz-go's pkg/sr: subjects,
versions, schema create/get/list, references, delete, compatibility
get/set/test, mode get/set, and context list/delete; scope to a context
with --context.

Schema-aware produce/consume:
- produce: --schema (value) / --key-schema (key) encode JSON into the
  registry wire format against an existing schema via a small spec
  (topic[@ver] | subject[@ver] | subject:NAME[@ver] | id:N, optional
  #message). Read-only; producing never registers.
- consume: --decode (=key/=value) decodes the wire format back to JSON.
- Avro (twmb/avro), JSON Schema, and Protobuf, including schemas that
  reference other registered schemas (resolved transitively).

Schema Registry config (URLs, basic/bearer auth, TLS, context) via
-R/--registry, -X registry.*, or a [schema_registry] config section,
defaulting to http://localhost:8081. -X / env config keys now also
accept a dot-separated form (sasl.user, registry.tls.server_name)
alongside the legacy underscore form.

'kcl fake' also serves an in-memory Schema Registry (srfake) on 8081 by
default; --seed-demo seeds avro/proto/json/plain demo topics.

Builds against the twmb/avro working tree via go.work until it is
released; franz-go pkg/sr is depended on directly.

A bare 'kcl acl list' left --type empty, which atoiResourceType maps to
UNKNOWN (0). UNKNOWN is not a valid DescribeACLs filter value -- brokers
reject the malformed filter, in the reported case by closing the
connection (read EOF on DescribeACLs). Default the list filter's --type
to 'any', a valid match-all. delete is unaffected: it requires an
explicit --type (guarding against deleting everything).