refactor(declarative): register ordered collection validation

[rspurgeon]

Adding a collection validator required separate edits to resource registration
and loader dispatch. This change registers the existing root validators and
derives the complete ordered collection pass from resource and selector
capabilities, so registration also supplies invocation.

• Co-locate nine managed-root validators and grouped audit-log destination
  validation; share type-wide name checks across seven roots while preserving
  namespace-specific, external, duplicate-ref, and nested API rules.
• Derive all 51 validation steps. Preserve services → audit-log destinations
  → certificates, API-before-Portal child validation, and organization selector
  ordering. Keep normalization, cross-references, and namespaces in the loader.
• Reject missing root dispositions, conflicting root/child validation, invalid
  typed registrations, missing inherited/selector phases, and duplicate
  positions. Explicit child phases work without a family default.
  Retain explicit Event Gateway validation omissions and the three loader
  methods called directly by existing tests.
• Add the authorized focused contract-test file: pin the full diagnostic
  sequence, assemble actual registrations directly, exercise rejection guards,
  and cover explicit phases without a family default.
• Update the authoritative implementation guide with the registration workflow,
  contract test, and remaining boundaries.

Validation: baseline and final candidate make test-all (lint, installer
checks, race-enabled unit/integration suites, and 99 E2E tooling tests);
read-only go fix -diff ./...; formatting with existing struct tags preserved;
and CGO-disabled make build-ci.

External production overlays compare 2,270 cases, each validated twice:
dispatch traces, errors, and serialized resource state match main. Nine
deliberate misregistrations trigger the expected guards. The new tests also
detect a deliberate phase permutation and removal of four dispatch/registration
guards; the explicit-phase regression test fails against the previous code.
This is bounded compatibility evidence, not exhaustive API coverage.
All 1,650 existing test/fixture files remain unchanged.

Refs #2079. This completes the ordered collection-validation milestone;
cross-pipeline capability completeness remains follow-up work.

[kong-api-ops]

✅ KSAI Review: Finished

1. 04:08 UTC Reviewing changed files and their diffs
2. 04:12 UTC Tracing validation ordering and registration logic across related modules
3. 04:14 UTC Reviewing changed files and tracing validation logic across modules

---

Run report (federated) · 1 paid run · $0.0452 total

#	Engine	Result	Model	Turns	Cost
1	opencode	success	zai-org/GLM-5.3-Flash/high	19	$0.0449

Reviewing cost $0.0449; deciding how to run it cost $0.0003

[kong-api-ops]

Check	Result
Scope	21 files: registry-driven collection-validation dispatch replacing per-type loader validation in internal/declarative
Mandate	go-code-reviewer (adversarial)
Findings	1 Medium, 2 Low
Findings audit	Completed

The phase table reproduces the removed hardcoded validation sequence exactly, including gateway-service/audit-log/certificate interleaving. The gaps are untested ordering and guards, plus one latent guard-ordering inconsistency. No additional concerns found: no secrets, no security surface, no resource leaks.