feat(ci): reconnect PPL lint validation to the candidate runtime grammar

[Hanyu-W]

What

Takes the cross-repository PPL lint check from the PoC to the design in ppl-lint-ci-validation-design.md. The detector half now lints against the candidate runtime grammar bundle the SQL PR builds — through OSD's production headless lint API — instead of the compiled analyzer or a hand-rolled reparse of OSD main's checked-in grammar. Both halves validate the same grammar, so a parser/semantic change that invalidates a lint rule reds the build.

Changes (SQL side; the OSD headless API ships separately)

• PplLintRuleValidationIT — exports the candidate grammar bundle (GET /_plugins/_ppl/_grammar) + a target manifest {engineVersion, grammarHash, grammarBundle} while the cluster is alive; reads schema-v3 specs; selects the one expectations[] entry matching the backend version (zero / >1 fails before execution); records observed backend behavior per query for the differential.
• integ-test/build.gradle — forwards -Dppl.lint.grammar.bundle / -Dppl.lint.target to the test JVM alongside the existing ppl.lint.* knobs.
• run-frontend-contract.mjs — deserializes the candidate bundle via the OSD headless API and lints each query with lintQueryWithBundle (runtime-bundle surface, so the runtime-only arity rules fire); pins dataSourceVersion + knownVersion to the candidate version; asserts the detector-vs-backend differential; fails loud on a missing bundle.
• Workflow — linear backend-validation → detector-validation → validation-result; artifacts are the only bridge between jobs. validation-result is the single always() required check (red unless both jobs succeed) and writes the per-rule PR summary; assemble-run-manifest.mjs emits run-manifest.json with the immutable SQL + OSD SHAs, mode, backend version, grammar hash, and enforced set. A workflow_dispatch osd_ref run is pre-merge evidence, not a protection result.
• Contracts — migrate all 9 specs to schema v3 (named queries{role,query} + version-scoped expectations[]); partition manifest.json into enforced (eventstats, multisearch, union, replace), pendingReview (field-validation), and nonEnforcing. Union/multisearch triggers are query-initial, not pipe-first: OSD prepends a synthetic source=t prefix to pipe-first queries, which would desync the two halves.
• scripts/ppl-lint/README.md — documents inputs, local reproduction, the contract format, and the failure table.

Testing

Verified end to end against a live cluster:

• Backend IT exports a real 248 KB candidate bundle + target.json; BUILD SUCCESSFUL.
• Detector runner agrees on all four enforced rules (triggers rejected + 1 diagnostic, controls accepted + 0) — green, exit 0.
• An intentional expectation mismatch reds the runner (exit 1).
• Manifest assembler emits a valid run-manifest.json.
• Java compile + spotless, and JSON/YAML/JS/shell syntax all pass.

⚠️ CI dependency

detector-validation checks out OSD main, but the @osd/monaco/ppl-lint + headless_ppl_lint API it needs is only on OSD commit 8a11123dca, not yet merged to OSD main. Until the OSD change merges, detector-validation will fail on a normal PR run; use workflow_dispatch with osd_ref=8a11123dca for pre-merge evidence (per the design's merge order).