feat(sync): add ID-targeted loading and per-dependency lazy loading

[michael-richey]

Summary

Stacked on #544.

Extends --minimize-reads with a faster strategy and lazy dependency loading:

ID-targeted loading (fast path): When all filters use Name=id+ExactMatch+OR, constructs storage keys directly and fetches only those files — no listing needed. For managed-sync's typical invocation (100 resources with exact ID filters), reduces reads from ~20,000 to ~204 (100 files + up to 100 dependency files, source+destination).

Lazy dependency loading: State.ensure_resource_loaded(type, id) lazily fetches cross-type dependencies when encountered in _resource_connections(). Loads both source and destination state so connect_id() can remap IDs correctly.

Strategy selection (automatic, in build_config()):

1. ID-targeted: all filters use Name=id+ExactMatch+OR → direct key fetch
2. Type-scoped fallback: non-ID filters or no filters → type-prefix listing (PR 2)

Note: get_by_ids() requires --resource-per-file and raises ValueError if called without it. All State instantiations that pass exact_ids must also pass resource_per_file=True.

Performance (10k dashboards + 10k monitors, 1-to-1 deps):

Command	Before	After
--resources=dashboards --filter=...Name=id... (100 IDs)	40,000 reads	~204 reads
--resources=roles (500 roles, type-scoped)	40,000 reads	~1,000 reads

Known limitation: monitors.py and restriction_policies.py have connect_id() overrides that access hardcoded destination types beyond resource_to_connect. With --minimize-reads, those types return empty dicts (no crash, just silent ID-remapping skip). Testing should confirm the specific types managed-sync syncs don't hit this.

Test plan

• pytest tests/unit/test_minimize_reads_id_targeted.py — 19 tests pass
• pytest tests/unit/ — full regression, 379 tests pass

🤖 Generated with Claude Code

[michael-richey]

Staff review of the ID-targeted loading + lazy dependency loading feature. The overall design is clean and the performance wins (40k → ~204 reads for the managed-sync use case) are compelling. Strategy selection in build_config is well-structured and the fallback chain is easy to follow. A few issues worth addressing before merge.

Critical

• ensure_resource_loaded has a repeated-miss performance problem when a dependency file doesn't exist at all — get_single is called on every invocation for that ID forever.

Significant

• get_by_ids is copy-pasted identically across S3, GCS, and Azure. It belongs in the base class.
• get_single ignores the origin parameter and always reads both source and destination, wasting I/O when only one side is needed.
• The ValueError catch in extract_exact_id_filters is unreachable given the surrounding f.operator == EXACT_MATCH_OPERATOR guard.

Minor

• No debug/info log when ID-targeted loading falls back to type-scoped — makes troubleshooting harder.
• Known connect_id() override limitation (monitors, restriction_policies) should surface a log.warning rather than silently skip, since silent ID-remapping failure is hard to detect in production.

Inline comments on the specific locations below.

[michael-richey]

The PR description calls out a known limitation: monitors.py and restriction_policies.py have connect_id() overrides that access hardcoded destination types beyond what appears in resource_connections. Those types won't be in the scoped load and ensure_resource_loaded won't be called for them, so their IDs will silently not be remapped.

Silent ID-remapping failure is very hard to detect in production — the sync appears to succeed but references in the destination resource are stale. Even if fixing the root cause is deferred, the failure should be surfaced:

# After ensure_resource_loaded + source check:
if f_id in self.config.state.source[resource_to_connect]:
    # it loaded successfully
else:
    if self.config.state._minimize_reads:
        log.warning(
            'minimize-reads: dependency %s.%s not found in storage; '
            'ID remapping may be incomplete', resource_to_connect, f_id
        )
    missing_resources.add((resource_to_connect, f_id))

At minimum, the test plan should include a case that syncs a monitor widget in a dashboard (which exercises the monitors override path) to confirm it doesn't silently break.

[michael-richey]

Fixed. Added a self.config.logger.warning call after the source check in _resource_connections. Noted in the comment that the monitors.py override (which accesses synthetics_tests directly in connect_id) won't be caught here since that path bypasses _resource_connections — fixing the root cause is a separate refactor.

The base branch was changed.

The merge-base changed after approval.