core: let from end with a step that names each subject

[jbpros]

First half of #52. Replaces #42.

from can end with {"each_as": "name"}. It isn't called each, because each already means a path into nested lists on all and any:

• Over an object, every entry is a subject, identified by its key and sorted by key. "keys": [...] says which entries must be there. A missing one is still a subject and fails as absent. Entries that aren't listed aren't checked.
• Over a list, every item is a subject, as before.
• A path that starts with $name reads the subject. This matters inside all and any, where a check on an item can now compare it with its subject ("right": ["$pr", "author"]). The row shows the value read through the name beside the list.

"from": ["build", "test_runs", {"each_as": "run", "keys": ["unit-test", "integration-test", "system-test"]}],

A badly written step (not last, more than one, a name that isn't a string or starts with $, keys that isn't a list, or an extra field) fails $well_formed and gives no subjects.

Not in this PR, coming in the second half: as on all/any to name the item, and refs that start with a name. For now {"ref": ["$pr", ...]} fails closed as <invalid ref>. keys can't be a ref yet either.

Changes the report

• A path whose first key starts with a single $ is now a name. A key like $schema must be written as {"literal": "$schema"}. Without that, the read fails as absent.
• Inside all/any, a path read through a name or $$input is now in the row's inputs and counted for the cause. A missing $$input value inside an element check used to give cause value, and now gives absent.
• A missing $$input value in the path of a check inside all/any ("path": ["$$input", ...]) now fails as absent, not value.
• A literal or selector in from now fails $well_formed. from never read them, so such a requirement found nothing and passed with min_subjects: 0.
• The $well_formed description, expression and inputs only change for requirements whose from has a step.
• Custom operators must read the document through value_at and $$input. While ergo checks, input holds ergo's names, not the policy's input.

How names reach the checks

Names travel in input, set once by report and per subject for requirements with a step. A with on data nested inside report's own with data.ergo_document copies the whole document each time, which made every policy about 20 times slower. With input, 1,000 subjects take 0.35s without a step (main: 0.27s) and 0.94s with one, and the time grows in line with the number of subjects (4,000: 1.3s and 3.7s). The evidence can't give names, because report replaces input for the whole evaluation.

Checked

• opa check --strict, opa fmt, opa test: 458/458, with every line covered. All 416 tests from main pass unchanged.
• Differential fuzz against main: 4,000 generated policies without naming steps, with $x keys wrapped in literal, give byte-identical reports and violations. Without the wrapping, 34 of 500 differ, so the fuzz does catch the intended change.
• Property fuzz: 2,000 cases where from: [items, {each_as: "it"}] with every path prefixed by $it gives the same verdicts and causes as plain from: [items].
• Mutations: dropping each new guard (scope in filter causes, the $ and last-step rules, extra fields, refs to names, missing key as null, name reads in causes, from in $well_formed) makes at least one test fail.
• Not checked: the Wasm runtime.

🤖 Generated with Claude Code