fix(security): wave-12 engine-primitive enforcement (readOnly, default-closed flag, bulk safeguards, dot-syntax, per-object authz)

[rubenvdlinde]

Context

This PR closes 5 engine-primitive gaps identified in the Wave-11.5 audit (/tmp/wave11-or-engine-primitives.md) where ~15 fleet leaf apps had been silently relying on OR engine guarantees that did not exist. Together they address the 4 fleet-class SHIP-BLOCKING issues surfaced in wave-11:

• openbuilt default-OPEN write (B1 in audit): schemas without an authorization block grant create/update/delete to every authenticated user.
• scholiq readOnly no-op (A in audit): readOnly: true was pure metadata, never enforced on writes.
• OR bulk-path bypass (/tmp/wave11-openregister-report.md SB2): POST /api/bulk/{register}/{schema}/save skipped PermissionHandler + Opis validation + @self stripping + appendOnly + PropertyRBAC.
• OR @self.organisation injection (SB1): the wave-9 fix(security): wave-7 critical C1 (RevertHandler RBAC) + C2 (@self injection allowlist) #2008 @self strip missed organisation on both single-object and bulk paths → cross-tenant data injection.

Per-fix summary

Fix 1 - JSON-Schema readOnly enforcement

• New ValidateObject::validateReadOnlyConstraints() compares incoming property values against the previously-stored object on UPDATE. CREATE is bypassed (no prior value).
• Wired into ObjectService::saveObject right after hard-validation.
• BC: silent no-op when no schema property declares readOnly: true (i.e. the entire fleet today). Schema authors can now start using readOnly as a real primitive.

Fix 2 - PermissionHandler default-closed flag

• New IAppConfig flag openregister:enforce_default_closed (default false). When true, schemas without authorization AND without explicit "public": true default-CLOSE create/update/delete for authenticated non-admins. Reads remain default-open.
• BC strategy: flag defaults to false, preserving wave-11 behaviour for the ~15 leaf apps that lack auth blocks. The engine logs a one-shot deprecation WARNING per action when the flag is off and a schema-without-auth grants a write — actionable signal for the next-major flip. Tracking issue filed for that flip + a fleet sweep of *_register.json.

Fix 3 - Bulk-save path safeguards

• New SaveObjects::applyBulkSafeguards() runs per-row before the transform/upsert pipeline:
  1. Strips @self.{owner,organisation,authorization} (and underscored forms) for non-admins — closes wave-11 SB1 + SB2 in a single place.
  2. Calls PermissionHandler::hasPermission per row.
  3. Enforces appendOnly schemas on UPDATE rows.
  4. Runs Opis JSON-Schema validation when _validation: true.
  5. Honours _rbac: false only for admin callers (non-admin payloads can't bypass).
• SaveObject::setSelfMetadata also gates @self.organisation behind callerIsAdmin() (defence-in-depth for the single-object path) — closes wave-11 SB1 organisation injection on both write boundaries.
• BC strategy: safeguards activate only when PermissionHandler is wired (production DI does inject it; legacy 7-arg test fixtures degrade gracefully).
• Performance note: per-row PermissionHandler checks are O(N) over the input batch. Existing baseline benchmarks ran at ~5000 obj/s with no per-row checks; expected throughput after this PR is closer to 2000-3000 obj/s. Tracking issue filed for a real benchmark + re-tuning.

Fix 4 - ConditionMatcher dot-syntax

• ConditionMatcher::resolveDynamicValue() now resolves \$user.uid, \$user.email, \$user.displayName, \$user.groups, \$organisation.uuid.
• Unknown \$user.<X> / \$organisation.<X> tokens log a warning and return null, which the matcher treats as deny — closes the silent-deny where \$user.unknownThing used to fall through as a literal string and silently never match.
• BC: bare \$user / \$userId / \$organisation continue to resolve identically.

Fix 5 - Per-object _authorization wired into resolution

• PermissionHandler::resolveAuthorization() accepts an optional ObjectEntity and merges its non-empty getAuthorization() action-by-action on top of the schema/register baseline.
• Precedence (highest wins): per-object → schema → register → null.
• BC: defaults to empty per-object _authorization (existing entity behaviour); the column was dead storage before, so nothing changes for any caller that doesn't start populating it.

Tests added

• 38 new regression tests across 4 files:
  • tests/Unit/Service/Object/Wave12ReadOnlyEnforcementTest.php (9 tests)
  • tests/Unit/Service/Object/Wave12PermissionHandlerDefaultClosedTest.php (10 tests; covers Fix 2 + Fix 5)
  • tests/Unit/Service/Object/Wave12BulkSafeguardsTest.php (7 tests)
  • tests/Unit/Service/Wave12ConditionMatcherDotSyntaxTest.php (12 tests)
• Updated 3 existing tests whose assertions encoded the wave-11 organisation-injection behaviour now closed by Fix 3.

Quality gates

• PHPUnit: 12955 tests (baseline+39), 24 failures (matches baseline), 3119 errors (matches baseline). No regressions.
• PHPStan: 12 errors (matches baseline). No new errors.
• PHPCS: clean on all modified lib/ files.
• php -l: clean on all touched files.
• Version bumped to 0.2.13-unstable.85.

Follow-ups

Tracking issues filed for:

1. Fleet sweep of *_register.json to add explicit authorization blocks ahead of the next-major default-closed flip.
2. Bulk-save performance benchmark and re-tuning after per-row guard application.

Do NOT admin-merge

Per the wave-12 brief: this is a production app, open the PR for review, do not admin-merge.