Move the target-path placeholder into the bucket slot, drop the dead public root

[serguei-gorokhov]

Parent: #1930

What to build

The declared-dependency target grammar now matches DIAL's real resource addressing, {type}/{bucket}/{path…}, uniformly: the current-user placeholder moves from the type slot (current-user/{type}/…) into the bucket slot ({type}/{current-user}/…), written literally with braces. Braces are collision-proof (INVALID_FILE_NAME_CHARS bans them in every path element) and fail closed if the branch is ever missed (a raw brace throws in fromAnyUrl's strict decode).

• GLOBAL_VIEW_ROOTS and PERSONAL_TYPED_ROOTS collapse into one DECLARABLE_TYPE_ROOTS set (segment 0, both forms) with the dead public entry dropped — public is a bucket value, never a type, so target.path: "public/somefile" previously passed write-time validation and was silently unresolvable at every request.
• The old early return that let a recognized placeholder skip the root-vocabulary check is deleted, not moved: the segment-0 vocabulary check now runs first, unconditionally, for both forms — otherwise credentials/{current-user}/… would have been accepted at write time. The same vocabulary check is now also enforced on the read side for concrete (non-placeholder) paths, closing a gap for config-file apps that bypass write-time validation.
• validateUserAuthored degenerates to the allowUserResourceDependencies flag check alone: shape validation already runs first and requires segment 0 to be a declarable type, so a root-level "write everything personal" declaration is not expressible under the new grammar at all.
• No back-compat or migration work: this grammar has never shipped to a real deployment. The old spelling is now a 400 at write time — flagged for review.

Acceptance criteria

• skills/{current-user}/ and files/{current-user}/notes/ validate and resolve to the originating user's bucket, keeping type and relative path.
• current-user/skills/ — the previously shipped spelling — is now a 400 at write time.
• public/somefile is a 400 at write time (was accepted-and-dead).
• credentials/{current-user}/, keys/{current-user}/, and concrete credentials/<bucket>/… are rejected at write time AND unresolvable at read time.
• Exactly one place in pathIssues checks segment 0, with no conditional above it; validateUserAuthored contains no path inspection.
• No current-user string remains in main code; in test code the only bare occurrences are deliberate fixtures — the old-spelling regression guards asserting 400, a bare mid-path word pinning it is an ordinary legal folder name, and the config module's inert-parse round-trip fixtures.
• Full suite green; the branch's e2e updated to the new spelling.

Blocked by

#1936

[serguei-gorokhov]

Implemented by #1946 (one PR of the stacked series publishing this feature; the PR's base is the previous story's branch — see the epic for the stack order).