feat(schema): dependentRequired parser + runtime enforcement (#193)

[zeevdr]

Closes #193.

Summary

Adds JSON Schema 2020-12 `dependentRequired:` keyword to decree's schema YAML format end-to-end. Forms the second of three Phase-1 subtasks for #76 (the cross-field validation umbrella) and lets schema authors express "if field A is set, field B must also be set" without reaching for CEL.

Behavior

```yaml
fields:
payments.refunds_enabled: { type: bool }
payments.refund_window: { type: duration, nullable: true }

dependentRequired:
payments.refunds_enabled: [payments.refund_window]
```

• Triggers on non-null. A rule fires only when the trigger has a non-null value in the post-merge config. Setting trigger to null clears the requirement.
• Lint at `ImportSchema`. Trigger and every dependent must reference a defined field; trigger may not list itself; no duplicate dependents.
• Runtime enforcement at every config write — `SetField` / `SetFields` / `ImportConfig` / `RollbackToVersion` — inside the existing transaction, against the post-merge snapshot. Race safety relies on Postgres MVCC + the existing `UNIQUE(tenant_id, version)` constraint on `config_versions`. See follow-up issue Retry config writes on CreateConfigVersion UNIQUE conflicts #196 for the caller-side retry on UNIQUE conflicts.

Implementation

• `proto/centralconfig/v1/types.proto`: new `DependentRequiredEntry` message + `Schema.dependent_required = 12`.
• `db/migrations/001_initial_schema.sql`: new `dependent_required jsonb NOT NULL DEFAULT '[]'` column on `schema_versions` (squashed into 001 per alpha policy).
• `internal/schema/dependent_required.go` (new): `validateDependentRequiredAgainstFields`, `marshalDependentRequired`, `UnmarshalDependentRequired`, `CheckDependentRequired`.
• `internal/schema/yaml.go`: `SchemaYAML.DependentRequired` field + `validateDependentRequiredYAML` lint + proto<->YAML converters.
• `internal/schema/service.go`: ImportSchema reads, lints, and persists the rules; GetSchema/ExportSchema round-trip them.
• `internal/validation/factory.go`: new `GetDependentRequired` and `InvalidateRules` methods. The factory now caches both per-field validators and dependentRequired bytes per tenant.
• `internal/config/service.go`: new `fetchDependentRequiredRules`, `enforceDependentRequiredInTx`, `mapDependentRequiredErr` — wired at all four write sites.
• `internal/config/store_pg.go`: `RunInTx` now binds both write and read query handles to the tx so reads inside fn observe staged writes (otherwise the post-merge snapshot read for the dependentRequired check would return pre-tx state on real PG).
• `docs/concepts/schemas-and-fields.md`: new "Cross-field dependencies" section.

Test plan

• Lint unit tests for `validateDependentRequiredYAML` and `validateDependentRequiredAgainstFields` — empty / valid / unknown trigger / unknown dependent / self-reference / duplicate.
• Marshal / unmarshal round-trip + edge cases (empty array, malformed JSON degrades to nil).
• `CheckDependentRequired` runtime — trigger absent / present-with-deps-present / present-with-dep-missing / first-violation-returned.
• proto<->YAML converters — stable order, empty-input semantics, full round-trip.
• YAML parser path: full `unmarshalSchemaYAML` covering valid, unknown trigger, unknown dependent, self-reference.
• SetField runtime — trigger-set-without-dependent rejected, both-present allowed, trigger-absent allowed, trigger-set-to-null allowed.
• SetFields aggregate path — single snapshot read for one rule check across multiple writes.
• RollbackToVersion + ImportConfig runtime — both reject when post-merge state violates rules.
• Validator factory rules cache — synctest-driven concurrent populator test under `-race`, plus invalidation forces re-fetch.
• `make test` passes (full suite, race detector on).
• `make lint` passes.

Out of scope (follow-ups)

• Retry config writes on CreateConfigVersion UNIQUE conflicts #196 — Retry config writes on `CreateConfigVersion` UNIQUE conflicts (improves UX for the race we already handle correctly).
• CEL expressions for advanced validation #76 / cel-discovery branch (PR docs: CEL validation discovery brief (#76) #191) — CEL engine for arithmetic / multi-field rules. The CEL design doc reserves the `validations:` key in v0.1.0 alongside this `dependentRequired:` work.