feat: resolve declared resource dependencies at request start (chat path)

[serguei-gorokhov]

Applicable issues

• fixes Resolve declared resource dependencies at request start (chat path) #1934
• Parent epic: App resource dependencies — scoped access for applications to user resources #1930

Description of changes

A new enhancement-chain function, ResolveResourceDependenciesFn, runs for chat-completion calls to an application, before the per-request key is assigned — while the context still carries the originating user, so the reach checks evaluate the USER's permissions, not the app's (load-bearing timing, made loud by an assert).

Per declared record: resolve the target (current-user/… against the originating user's bucket, concrete global-view paths as-is), verify fresh against the user's reach, intersect with the content-bound admin-consent record, and bake the passing grants into the key the application will hold.

• Fail-closed per record: unreachable or unconsented targets simply do not grant; a required record that cannot resolve fails the call with an explicit 403 instead of the app half-working. Reach is all-or-nothing per record — no half-grants.
• Malformed records (config-file apps bypass write-time validation) are unresolvable — never a crash, never a grant; the read side re-enforces the write-side vocabulary (kind, READ/WRITE only).
• Runtime audit on the DIAL_RESOURCE_DEPS_AUDIT stream: one grant line per run (what was granted), one denial line (unreachable or unconsented), one runtime-fail line when a required record rejects the call.
• Enforcement is unchanged — the existing per-request permission rule honors the grants, folder targets by prefix.

Smoke test proves the v1 happy path end to end: admin-authored app declares current-user/prompts/dep-smoke/ (write, required) → admin grants → user chats → the app's key writes inside the declared folder (200) and is refused outside it (403).

Behavior changes flagged for review

• An app that declares a required dependency can now fail chat-completion calls with an explicit 403 (reach or consent missing) — new failure mode, only for apps that opt in by declaring.
• The timing assert makes wiring-after-key-assignment fail loudly rather than silently resolve against the wrong identity.

Checklist

• Title of the pull request follows Conventional Commits specification

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

🤖 Generated with Claude Code