bug(dynamic): unportablized ruleset ids are written silently — wrong-host rulesets fail quietly, not loudly #101

Problem

Ruleset portablization only rewrites references to managed resources. Anything pointing at an
unmanaged target stays a raw numeric id — and nothing says so.

Across eqrm/ct-structure's rulesets/ (9 files), portablized: group-type-role ×22,
campus ×7, group-type ×4, group ×2. Still raw in 5 of 9 files:

Why it matters: it fails SILENTLY and WRONGLY

ChurchTools treats a ruleset as opaque JSON. It does not validate the ids inside. So a ruleset
carrying prod's ctgroup.id applied to dev does not error — the auto-group simply collects the
wrong people, or nobody, and ct plan stays green because the ruleset round-trips byte-identically
against the host it was written for.

Compare with how #98 handled the same class of problem for permission scopes: an unresolvable
{ department: … } ref is a hard error, explicitly "strictly better than a silent numeric
misgrant". Rulesets currently take the opposite position for the same kind of id.

This is materially worse than a wrong permission scope, because the payload of an auto-group is
group membership — and in this instance Struktur membership carries 33 grants.

Suggested fix

Ranked by value:

1. Report what could not be portablized. At ct adopt --with-dynamic and at plan time, list
   each dimension left numeric and why (target not managed / no ref kind for this dimension). Even
   with no other change this converts silent wrongness into a known risk.
2. Extend the ref kinds to the dimensions that have resolvable catalogs — role.id maps to
   role-def (/group/roles), which already exists as a RefKind, and person.campusId /
   ctgroup.groupTypeId are just campus and group-type refs appearing in a ruleset position rather
   than a scope position.
3. ctgroup.id needs the target group adopted, exactly like a cdb_gruppe scope — so the
   right behaviour is the feat(permissions): portable scope refs for non-group dimensions (cdb_station, cdb_bereich, cdb_gruppentyp) #98 one: resolve if managed, otherwise error (or warn under an opt-out)
   rather than freeze prod's id into a cross-host file.

A strictRulesets: true config switch that refuses to write a ruleset containing an
unportablized id would let a repo opt into the safe behaviour before it becomes the default.

Acceptance

• Adoption reports every dimension it left numeric, with the reason.
• role.id, person.campusId and ctgroup.groupTypeId portablize when the target resolves.
• ctgroup.id portablizes when the target is managed; otherwise it is surfaced, not swallowed.
• A repo can opt into "refuse to write an unportablized ruleset".

Related: #76 (the original portablization work), #98 (the resolve-or-error precedent for scopes).