don't run ensure in background in case of first push

pkg/appview/middleware/registry.go

···
 	// Auto-reconcile crew membership on first push/pull
 	// This ensures users can push immediately after docker login without web sign-in
 	// EnsureCrewMembership is best-effort and logs errors without failing the request
-	// Run in background to avoid blocking registry operations if hold is offline
+	// Run synchronously to ensure crew record exists before write access checks
+	// (returns quickly if already a member - hold returns 200/201)
 	if holdDID != "" && nr.refresher != nil {
 		slog.Debug("Auto-reconciling crew membership", "component", "registry/middleware", "did", did, "hold_did", holdDID)
 		client := atproto.NewClient(pdsEndpoint, did, "")
-		go func(ctx context.Context, client *atproto.Client, refresher *oauth.Refresher, holdDID string) {
-			storage.EnsureCrewMembership(ctx, client, refresher, holdDID)
-		}(ctx, client, nr.refresher, holdDID)
+		storage.EnsureCrewMembership(ctx, client, nr.refresher, holdDID)
 	}
 
 	// Get service token for hold authentication (only if authenticated)