fix(graph): reject physical queue feedback and source aliases

[albertovincenzi]

Problem

The graph validator only treated explicitly declared ingress queues as owned inputs. The compiled plan also contains Gate-owned interior source queues, so two unsafe physical topologies passed validation even when the logical node DAG looked acyclic:

• another node or graph could declare a Gate interior queue as its ingress, creating a second consumer group that receives and forwards every message;
• a terminal egress could point back to any source in the same graph, including the one-node ingress=egress case, making admitted messages circulate forever and repay budgets on every turn.

Fix

• derive queue ownership from every compiled stage source, including interior queues;
• apply that ownership consistently within one document, against the local registry, and against graphs loaded from the durable store;
• reject a terminal destination that aliases any source in its own graph with a dedicated queue-cycle validation problem;
• add unit coverage for local alias/feedback cases and a broker-backed regression for cross-graph interior ownership.

Notes for Alice

Normal graph-to-graph chaining remains legal: graph A may write to a queue that graph B owns as its ingress. The producer does not claim its terminal egress as a source. The new refusals only prevent multiple Gate consumers of the same physical source and feedback from a graph's terminal output into one of its own sources.

The durable-store collision check is still a read/check operation, as before; this PR strengthens which queues it checks but does not claim to solve a simultaneous cross-replica declaration race.

Verification

• cargo fmt --all -- --check
• cargo test --workspace
• cargo clippy --workspace --all-targets -- -D warnings

[albertovincenzi]

This rule is retroactive on documents that are already in the store.

restore and reconcile both go through declare_from_store → declare_locked(.., from_caller = false) → validate_with, with no exception. A single Problem therefore means the graph is not registered on the next restart: its pushes answer 404 and its ingress queue fills behind one WARN line.

#66 draws the line — a stored document is refused only for nodes, paths or a name that cannot become a queue name and a kv key, and everything else is logged and kept running. Suggest basing this PR on it, or merging it first.

For #34 specifically this is not hypothetical: airbnb/content and airbnb/messages in crates/core/tests/testdata/v1_channel_go_graphs.json carry only conditional budgets, and the passthrough remedy in migrate.rs never runs again once a document has been re-saved in v2 shape.

https://claude.ai/code/session_012K8u7BEJyd6nDNMCQAgH3z