feat(catalog): enforce component policy at runtime

[erichare]

Summary

• add exact, recursive catalog-policy validation for flow component types
• reuse one immutable snapshot across stored, migrated, and nested executable identities
• enforce policy in graph construction, authenticated build/run paths, and public builds
• preserve generic public errors and default-allow performance

Jira

• LE-1939
• Epic: LE-1864

Stack

• Base: feat/agent-catalog-templates (feat(catalog): filter starter templates by policy #14321)
• This PR should merge after its base PR

Validation

• LFX flow-validation and graph suites: 95 passed, 1 skipped
• authenticated build, run-by-id, private-access ordering, and public 400 mappings verified
• Ruff and pre-commit hooks passed
• Independent code and security reviews found and closed legacy migration bypasses, then reported no remaining findings

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

🗂️ Base branches to auto review (1)

• release-.*

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 3232e6e2-3201-4950-8881-41f6e32e96f0

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

✅ Test Coverage Advisor

No source changes detected without accompanying tests. Thanks for keeping coverage up! 🎉

Advisory check only — never blocks merge.