Reduce validation cost

[satyakigh]

This change lowers validation latency and memory use by sharing schema metadata and avoiding repeated work.

What changed

Shared validation state

• Parses schema metadata once into a typed catalog shared by the schema validator and rule engines.
• Reuses one schema validator by reference and shares its metadata catalog through reference-counted state.
• Reuses memoized resolved scenarios through shared immutable allocations.
• Preserves additional-schema behavior by replacing metadata only for overlaid resource types.
• Returns metadata parsing failures as errors instead of panicking.

Less work per validation

• Validates authored properties and reachable conditional-branch properties instead of traversing absent schema properties.
• Uses the model's resource-type index rather than rebuilding or scanning global type collections.
• Groups primary-identifier scenarios by identity before compatibility checks while preserving deterministic comparison order.
• Indexes VPC CIDRs and checks each subnet against its referenced VPC in one pass.
• Builds membership-oriented regional enum sets only when relevant resource types are present.

Performance

Representative reductions versus main:

Repeated validation latency

Workload	CEL	Rego
Mixed real templates	36% lower	8% lower
500 independent resources	62% lower	14% lower
500 resources with unique primary identifiers	77% lower	25% lower
500 resources sharing a primary identifier	63% lower	13% lower
100 conditional resources	67% lower	3% lower
Scenario-assignment boundary	40% lower	37% lower

First validation and memory

Ranges below span the CEL and Rego engines.

Workload	Initialization + first validation	Peak RSS
Mixed real templates	14–16% lower	10–11% lower
500 independent resources	12–23% lower	9–11% lower
500 resources with unique primary identifiers	20–33% lower	11–15% lower
500 resources sharing a primary identifier	15–32% lower	10–16% lower
100 conditional resources	14–18% lower	10–12% lower
Scenario-assignment boundary	31–32% lower	9–10% lower

Schema metadata is now initialized during engine construction, so construction-only operations do more work. Initialization plus first validation is nevertheless faster for the workloads above, while repeated validation latency and peak memory are lower.