fix(sdl): rewrite ACL networks and detection source artifacts when a module is imported under a namespace #1579

Gap Claim

Two references stay unrewritten when a module is imported under a namespace, so a module that is valid alone fails composition:

• An infrastructure ACL's from_net. A module with switch node lan, infrastructure lan and an ACL from_net: lan validates alone. Imported as first and second, it fails with Infrastructure 'first.lan' ACL references undefined network 'lan' (and the same for second.lan). The networks are rewritten to first.lan and second.lan; from_net keeps lan. specs/sdl/references.md §6 lists infrastructure.*.acls[].from_net as a reference into infrastructure.
• A security-monitoring manager detection definition's source_artifact_ref, which semantic validation resolves as a declared reference (raes/validator/_runtime_platform.py). A module whose definition names nodes.app validates alone. Imported twice, it fails with Node 'first.app' runtime security-monitoring manager 'siem' detection_definition 'detection-definitions' source_artifact_ref 'nodes.app' does not reference any defined element (and the same for second.app).

Both reproduce on dev a391904 with parse_sdl_file on a root that imports the module twice. Found while building the twice-imported stage matrix for #1339 (PR #1446), whose matrix payload leaves both fields out for this reason.

Existing Surface Audit

• raes/composition/_expand.py and raes/composition/_references.py rewrite the reference fields that the reference catalog names under the import namespace. Neither rewrites from_net nor source_artifact_ref (no match for either name under raes/composition/).
• The infrastructure validator (raes/validator/_nodes_infra_network.py) checks from_net against infrastructure names, and _runtime_platform.py checks source_artifact_ref through the shared named-reference check.

Alternatives

1. Do nothing: such modules can be imported once only. Rejected, because ADR-053 composition is meant to let one module be imported under several namespaces.
2. Resolve these fields relative to the importing namespace at validation time: rejected, because it adds a second resolution rule beside the composition rewrite.
3. Add both fields to the composition's reference rewriting, as for the other catalogued reference fields: selected.

Chosen Architecture

Composition rewrites an ACL's from_net into the importing namespace when it names a network the module declares, and rewrites a detection definition's source_artifact_ref when it names a declaration the module exports, using the existing rewrite path and the reference catalog's candidate domains.

Verification Plan

• A module with an ACL from_net and a detection definition source_artifact_ref validates when imported once and twice, and each copy names its own namespace's declarations.
• A value that names no module declaration keeps today's diagnostic.

Related

• Make target eligibility explicit and align editor suggestions #1339, feat!: make reference eligibility explicit per purpose and align the editor with validation #1446, ADR-053