feat(config): lint errors on reserved-schema usage

[joshua-temple]

Problem

cascade lint (step 1) rejects unknown top-level keys, but a manifest that
populates a field which parses but is not wired to generation still lints
clean and generates an inert result. Those reserved fields should be a hard
error, not a silent no-op.

Fix

A hand-verified reserved-field registry (internal/config/reserved.go), wired
into Validate() so it errors through cascade lint and the generate path.
It mirrors the globalOnlyComponentFields pattern and maps each field path to a
category with a distinct message:

• not-yet-wired: ... is reserved and not implemented in this cascade version
• wrong-place (callback timeout_minutes): ... timeout belongs in the called workflow, not the caller

The walk covers the top level, every component, and external repos.

Consumed-vs-reserved evidence (verified against internal/generate)

Field	Verdict	Evidence
telemetry	reserved	no reference under internal/generate
deploys[].rollout.type / .canary / .blue_green	reserved	not read by writeDeployStrategyOptions; no generate reference
deploys[].deploy_target	reserved	no generate reference
release.version_overrides	reserved	no generate reference
callback timeout_minutes	reserved (wrong-place)	populated into graph nodes (graph.go) but never emitted
rollout.max_parallel / rollout.fail_fast	consumed	emitted at promote.go:797-806, generator.go:1100-1104
job_timeout_minutes	consumed	emitted at generator.go:216
target_sha	out of scope	lives on EnvState (component state), not the manifest surface, so it never reaches manifest lint

Migration

Reserved usage now errors, so in-repo fixtures that populated reserved fields
were updated: the four reserved-shape e2e scenarios (their premise, that a
reserved field generates byte-identically, no longer holds) are removed and
replaced by 59-lint-reserved-rejection.yaml, which proves the merge-queue lint
lane reds on a reserved field. The reserved structural unit tests now assert the
rejection while retaining their direct structural-validator coverage. The
reference/manifest.md and reference/versioning.md reserved-field docs note
that cascade lint rejects their use.

Verification

go build ./..., go test ./..., go test -race ./internal/config/... ./internal/generate/...,
and golangci-lint run ./... all clean (root and e2e module). New reserved
tests fail before the registry and pass after.