fix(cluster): validate policy bundle semantics

[viveknathani]

What & why

Semantically validate referenced policy bundles during shared cluster config loading, so cluster validate, plan, and apply report policy_invalid before acquiring the cluster lock or creating state. This prevents invalid policy scopes from surviving until server boot and adds regression coverage and documentation for the validation boundary.

Backing issue / RFC

• Fixes an accepted issue: Closes cluster validate/apply should semantically validate policy bundles #201
• Implements / is an accepted RFC: <link to docs/rfcs/NNNN-*.md>
• Trivial fast-lane (typo / docs / dependency bump / comment / one-line CI) — no issue/RFC required

Checklist

• Change is focused (one logical change)
• Tests added/updated for behavior changes (or N/A)
• Public docs updated if user-facing surface changed (or N/A)
• Reviewed against docs/dev/invariants.md — no Hard Invariant weakened, no deny-list item hit (or justified)

Local verification

• cargo test --workspace --quiet — passed
• git diff --check — passed

Notes for reviewers

Policy validation now runs through the shared cluster config path, so validate, plan, and apply reject invalid bundles consistently and before changing cluster state.

Existing test fixtures were updated to include the required policy version.

Greptile Summary

The PR moves semantic policy validation into shared cluster configuration loading, causing invalid bundles and binding-kind mismatches to fail before cluster state or locking operations.

• Parses and validates each policy bundle while constructing desired cluster state.
• Checks cluster-bound policies with the server policy loader and graph-bound policies with the graph policy loader.
• Adds cluster and CLI regression coverage, updates fixtures to include policy version 1, and documents the validation boundary.

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains; the previously reported binding-kind gap is now enforced through the appropriate server and graph policy loaders before stateful cluster operations.

Important Files Changed

Filename	Overview
crates/omnigraph-cluster/src/config.rs	Shared desired-state loading now validates policy semantics and graph/server action-kind compatibility before retaining policy bindings.
crates/omnigraph-cluster/src/tests.rs	Adds direct regression coverage for invalid scopes, binding-kind mismatches, and pre-lock/pre-state apply refusal.
crates/omnigraph-cli/tests/cli_cluster.rs	Adds command-level coverage proving cluster validation reports actionable policy_invalid diagnostics.
crates/omnigraph-server/tests/multi_graph.rs	Updates the cluster server-policy fixture to use an explicitly server-scoped graph_list rule.
docs/user/clusters/config.md	Documents semantic policy and graph/server binding validation as part of cluster configuration checks.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart LR
  A[cluster.yaml and policy YAML] --> B[load_desired]
  B --> C[PolicyConfig semantic validation]
  C --> D{applies_to}
  D -->|cluster| E[Server policy kind validation]
  D -->|graph| F[Graph policy kind validation]
  E --> G{Valid?}
  F --> G
  G -->|No| H[policy_invalid diagnostic]
  G -->|Yes| I[DesiredCluster]
  I --> J[validate / plan / apply]
  J --> K[Lock and state operations]

Loading

_{Reviews (2): Last reviewed commit: "fix(cluster): validate policy binding ki..." | Re-trigger Greptile}

Context used (3)

• Knowledge Base — Cluster Orchestration (omnigraph-cluster)
• Knowledge Base — Policy enforcement (Cedar)
• Knowledge Base — Dev conventions and invariants