feat(declarative): expand external resource lookups

[rspurgeon]

Summary

• centralize declarative external lookup capabilities and relationship metadata
• expand external lookup support across eligible resource types, including APIs and authentication strategies
• allow managed API children and role assignments to resolve external API parents without placing those parents in apply or sync scope
• resolve dumped API publication auth strategy refs to resources recreated earlier in the same sync instead of reusing stale UUIDs
• document lookup contracts and add declarative, integration, unit, and end-to-end coverage

Validation

• go fix ./...
• make format
• make build
• make test
• make test-integration
• E2E: dump/portal-owned

make lint reports the existing 56 generated/mock-file findings (50 line-length, 4 spelling, and 2 staticcheck); this change introduces no lint findings.

Closes #1674

[rspurgeon]

/ksai review

[github-actions]

Run report (federated)

Item	Detail
Conclusion	success
Reviewed commit	3f851a3eeb1534ba7dc30173537b4a1e3df1c948
Model	claude-opus-5 (effort high)
Arm source	caller default
Triage	49 files, 2166 lines, risk true, api false, skills go-code-review
Triage reasons	a change on an auth path decides who gets in
Plugin ref	7a653240672e97f9a61309a09d3617270ce34677
Prompt
Duration	1180s (19 turns)
Input tokens (incl. cache)	665097
Output tokens	10267
Permission denials	6
Total cost	$7.6698
Classifier	off — the comment named a verb, or no arm was usable

[github-actions]

Verdict	APPROVE_WITH_COMMENTS
Critical/High	0

The change adds a generic external-lookup registry, relationship discriminators, and _external support for Catalog APIs and application auth strategies. The refactor is internally consistent and has good unit, integration, and E2E coverage. One Medium issue survived the audit pass: the new shared auth-strategy resolver depends on an index alignment that the UPDATE planner path does not guarantee.

Additional Risk pass over the non-Go files (docs, example YAML, E2E scenario and testdata) found no leaked secrets, no new attack surface, and no resource leaks.