partial writes + CachedOntology + route validation

Addresses the five concrete gaps the brutally-honest review on #309
called out:

  1. arrow_type_for_semantic no longer collapses everything to Utf8.
     Currency → Float32, Date(_) → Date32, CustomerId / InvoiceNumber
     → UInt64. DataFusion can now do real numeric / temporal predicate
     pushdown on those columns. The remaining semantic types stay
     Utf8 by deliberate choice — round 3 may pivot specific ones (Geo
     → struct{lat,lon}) when a consumer asks.

  2. CachedOntology helper extracted upstream. Bundles an Arc<Ontology>
     with eagerly-projected DTOs per Locale (De/En). Prevents the
     per-call OntologyDto::from_ontology rebuild that medcare-rs's
     MedcareOntology and smb-office-rs's session ontology both grew
     independently. One implementation, one bug surface.

  3. validate_route(route, ontology) added to parallelbetrieb. Parses
     /api/{entity_type}/{...} and asserts entity_type resolves to a
     declared Schema.name (case-insensitive). 4 tests covering
     accept-valid, reject-typo, reject-missing-prefix, reject-empty.
     Used as a pre-flight check for static route lists; the runner
     itself doesn't gate on it because typo routes are still genuine
     drift telemetry.

  4. from_columns_partial added for PATCH-style upserts. Allows
     omitted Optional / Free columns (filled with Arrow null arrays);
     still rejects missing Required columns and undeclared columns.
     The existing from_columns keeps its strict full-row contract.

  5. route_for_column now reads OuterColumn.codec_route directly,
     copied from the upstream PropertySpec.codec_route at schema
     derivation. Round-1 went through route_tensor which is
     calibrated for model-weight tensor names (q_proj, lm_head, ...)
     and would silently mis-classify document predicates. The
     contract's own field is now the source of truth — drift-by-
     construction impossible.

Adds 7 new tests (6 in transcode/ + 1 implicit in cam_pq_decode
where the existing test was rewritten to assert the new semantics):
  - cached_ontology_projects_every_locale_at_construction
  - cached_ontology_clones_are_arc_cheap
  - cached_ontology_inner_round_trips
  - validate_route_accepts_known_entity_type
  - validate_route_rejects_typo_entity_type
  - validate_route_rejects_missing_api_prefix
  - validate_route_rejects_empty_entity_segment
  - route_for_required_scalar_column_uses_property_spec_default
    (rewritten from route_for_scalar_columns_skips_codec; old test
    asserted the wrong thing — required scalars should default to
    Passthrough, not Skip)

Verified:
  cargo check across {default, query-lite, query-lite+audit-log+
    auth-rls-lite} — clean
  cargo test transcode:: → 33/33 passed (was 26/26 in #309; +7
    new + 1 rewritten)
  cargo clippy on the same combos — zero transcode warnings
  rustfmt --check — clean across all 4 modified files

…ring

F1 (MySQL <-> SPO oracle parity) shipped via MedCareV2 PRs #1, #2, #3,
medcare-rs PR #71, and lance-graph PR #309. The vision doc still claimed
F1 was "the next concrete deliverable". Rewrite section 7 to: state F1
has shipped, describe the LanceProbe -> ParityWitness -> DriftSink flow,
name the contract DTO
(lance-graph-callcenter::transcode::parallelbetrieb::DriftEvent), list
F1's known gaps (no latency claims; in-memory ring buffer), and state
F2 RBAC+audit wiring (medcare-rs adopting RlsRewriter) as the next
posture. No other sections touched.

Adds the missing reverse-direction helper: takes a stream of
ExpandedTriple (what Ontology::expand_entity returns) and
materialises a RecordBatch grouped by subject_label. This is the
Phase 5 (in #309's ROADMAP) / Phase 2-B (in the SQL-SPO bridge
plan) bridge that consumer code needs to roundtrip an entity row
through the SPO substrate.

## Why this shape (and not 'walk SpoStore::scan(lookup)')

The original Phase-2 plan-doc described 'walk SpoStore::scan(lookup)'
as the read path. SpoStore (in lance-graph proper) is
fingerprint-Hamming-indexed and doesn't expose a flat scan(lookup)
method — its API is per-verb (query_forward / query_reverse /
query_relation) and the FNV-1a fingerprint is one-way (subject can't
be reversed back to entity_id).

ExpandedTriple is the right input shape: it carries the canonical
subject_label (`entity:{type}:{id}`) so entity_id is recoverable,
and the contract crate already mints these via SchemaExpander.
Consumers wire SpoStore -> ExpandedTriple -> RecordBatch through
their own subject_id-aware reader; this helper does the second
step canonically.

## What ships

  triples_to_batch(soa, &[ExpandedTriple]) -> Result<RecordBatch>
    - Groups by subject_label (BTreeMap, lex sort, stable)
    - Parses entity_id from `entity:{type}:{id}`
    - Emits one row per subject; missing-required surfaces as
      MissingColumn error
    - Drops triples whose predicate isn't declared in the schema
      (BBB outer-view rule)
    - Rejects mixed entity_type via EntityTypeMismatch

  round1_lenient_schema(soa) -> SchemaRef
    - Round-1 helper: every body column emitted as nullable Utf8.
      The typed schema (Float32, Date32, etc.) applies on the
      from_columns / from_columns_partial path which has typed
      input. Round 3 adds typed-value reconstruction inside
      triples_to_batch.

  parse_entity_id_from_label(label, expected_type) -> Option<u64>
    - Private helper. Matches the canonical mint format.

Two new TranscodeError variants:
  EntityTypeMismatch { expected, got }
  BadSubjectLabel(String)

## Tests

5 prior + 7 new (zerocopy:: total 12, all pass under query-lite +
auth-rls-lite):
  triples_to_batch_produces_one_row_per_subject
  triples_to_batch_rejects_mixed_entity_types
  triples_to_batch_returns_empty_batch_for_empty_input
  triples_to_batch_drops_undeclared_predicates_silently
  triples_to_batch_rejects_missing_required_column
  triples_to_batch_subject_label_round_trip
  triples_to_batch_preserves_lex_subject_order

## What's deferred

- Typed value reconstruction (round 3): every body column emits
  Utf8 today; round 3 parses object_label according to
  semantic_type (Currency -> Float32, Date -> Date32, etc.).
- SpoStore reader proper: still needs a side-table mapping
  subject fingerprint -> entity_id. Consumer-side; tracked in
  `.claude/plans/sql-spo-ontology-bridge-v1.md`.

Verified: cargo check + cargo test transcode::zerocopy:: -> 12/12
pass under {query-lite, query-lite+auth-rls-lite}. Clippy clean,
fmt clean.