PDS: validate published permissioned-space record schemas

[slanos]

What & why

Closes #5433.

Permissioned spaces can declare third-party collections, but strict record writes currently fail against the PDS static schema table even when the collection owner has published a proof-verifiable Lexicon. This adds a generic published-record resolver to the three space write routes while preserving generated schemas as the static-first path.

For an unknown collection, dynamic resolution runs only when validate: true. It uses a separate DNS-authority LexResolver (not the OAuth test-authority override), the existing safe-fetch/proof-verification path, and LexiconSchemaBuilder. It requires an exact record #main, validates the record key and body, and returns only sanitized failures.

Resolution work is bounded by TTL/size-limited positive and negative caches, per-NSID singleflight, 32 active root builds, 32 unique documents, 128 reference lookups, four concurrent document fetches, and a ten-second aggregate build deadline. Batch actions are authorized before any resolution. putRecord fully prepares outside the actor transaction, rechecks existence transactionally, and reauthorizes if a create/update race changes the required action.

The integration fixture publishes a real third-party record Lexicon, then exercises create, put-create, put-update, and applyWrites through the real PLC/DID/repo-proof resolver path. Failure tests cover invalid records, missing/non-record schemas, cache bounds, fanout/concurrency/deadline bounds, resolver sanitization, unauthorized prefetch, and put race reauthorization.

Verification

• pnpm verify — passes repository-wide style, lint, and import checks.
• packages/dev-env: pnpm build — passes.
• packages/pds: pnpm build — passes.
• forced PDS test TypeScript build — passes.
• packages/pds: pnpm test — 53/53 suites, 587 passed, 1 skipped, 1 todo, 31 snapshots.
• focused resolver/prepare/space/auth suites — 81/81 tests.
• independent security/correctness review — no remaining P0-P2 findings.

pnpm build --force reaches an existing TypeScript failure in untouched packages/common/tests/car.test.ts because Jest globals (describe, it, expect) are absent from that test project. This branch changes no packages/common or root/common tsconfig files; the PDS/dev-env build and PDS test typecheck are green.

Checklist

• pnpm build --force && pnpm verify passes — verify passes; the root build has the unrelated baseline failure documented above.
• Tests pass, and new behavior is covered by tests
• A changeset is included for every package this touches
• Written with the help of an LLM or coding agent: OpenAI Codex, GPT-5.6 Sol. The complete diff was read and independently reviewed; blocker findings were fixed before publication.