Integration: apply-time type-checking of rule expressions against schema field types

[rrrodzilla]

Workstream: Integration · Part of #89

Context

A core advantage over hooks: rule expressions can be type-checked against schema field types at parse/apply, so a bad rule fails before deploy instead of on a live request.

Scope

• Type-check every rule expression against the schema's field types at apply time.
• Validate result-type compatibility (@compute result matches field type; @require is boolean; @default(expr:) matches field type).
• Surface failures with file:line.

Acceptance

• apply rejects type-incorrect rules; valid rules pass. Covered by the validation pipeline (sf-validate).

---

Dependencies: Suggested order: follows #103; pairs with #91. Soft.

[rrrodzilla]

Landed in b6856e0 — feat(cel): type-check rule expressions against field types at parse (#104).

Apply-time static type-checking of @require/@compute/@default against schema field types is wired into the DSL parse pipeline (which both sf parse and sf apply call), so a type-incorrect rule fails before deploy with a file:line diagnostic.

• New pure check module in schema-forge-cel: a TOTAL, conservative inferencer (Dyn whenever uncertain — never a false positive) plus field_accepts mirroring the runtime coercions, and check_rule (require→bool; compute/default→assignable to field type). Errors only when the top-level result type is definitely known and definitely incompatible.
• DSL surfaces failures as DslError::RuleTypeError { message, line, column, span }; the CLI renders a span underline + suggestion.
• Verified: clippy -D warnings clean; 1980 workspace tests pass (32 new across cel check + dsl parser).

Follow-up noted: unknown-identifier (field-typo) detection is deliberately out of scope here (idents not in the env infer to Dyn to avoid false positives); it could be added as a stricter opt-in check later.