fix: move the target-path placeholder into the bucket slot, drop the dead public root

[serguei-gorokhov]

Applicable issues

• fixes Move the target-path placeholder into the bucket slot, drop the dead public root #1937
• Parent epic: App resource dependencies — scoped access for applications to user resources #1930

Description of changes

The declared-dependency target grammar now matches DIAL's real resource addressing, {type}/{bucket}/{path…}, uniformly: the current-user placeholder moves from the type slot (current-user/{type}/…) into the bucket slot ({type}/{current-user}/…), written literally with braces. Braces are collision-proof (INVALID_FILE_NAME_CHARS bans them in every path element) and fail closed if the branch is ever missed (a raw brace throws in fromAnyUrl's strict decode).

• GLOBAL_VIEW_ROOTS and PERSONAL_TYPED_ROOTS collapse into one DECLARABLE_TYPE_ROOTS set (segment 0, both forms) with the dead public entry dropped — public is a bucket value, never a type, so target.path: "public/somefile" previously passed write-time validation and was silently unresolvable at every request.
• The old early return that let a recognized placeholder skip the root-vocabulary check is deleted, not moved: the segment-0 vocabulary check now runs first, unconditionally, for both forms — otherwise credentials/{current-user}/… would have been accepted at write time. The same vocabulary check is now also enforced on the read side for concrete (non-placeholder) paths, closing a gap for config-file apps that bypass write-time validation.
• validateUserAuthored degenerates to the allowUserResourceDependencies flag check alone: shape validation already runs first and requires segment 0 to be a declarable type, so a root-level "write everything personal" declaration is not expressible under the new grammar at all.

No back-compat or migration work: this grammar has never shipped to a real deployment.

Behavior changes flagged for review

• The old spelling is now a 400. current-user/skills/ — the previously shipped placeholder form — is rejected at write time; every declaration must use the braced {type}/{current-user}/… form.
• public/somefile is now a 400 (was accepted-and-dead); credentials/{current-user}/… and concrete credentials/<bucket>/… are rejected at write time and unresolvable at read time.

Checklist

• Title of the pull request follows Conventional Commits specification

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

🤖 Generated with Claude Code