fix(585): validate context_scope directives against the closed registry

[Muizzkolapo]

Summary

normalize_context_scope silently accepted any unrecognized context_scope directive: it copied the value into the normalized scope, where no downstream consumer ever reads an unknown key (consumers only read observe/passthrough/drop/drops/seed). So a typo like observ: scoped nothing and raised no error — a silent-config-typo class. A hardcoded REMOVED_DIRECTIVES = {"seed_path": "seed", "static_data": "seed"} map loudly caught two specific removed names with a rename-migration message, while every other typo stayed silent.

Both are replaced with one closed-set guard: a directive name not in DIRECTIVE_REGISTRY raises ConfigurationError naming the key and listing the valid set (derived from the registry). Typos, removed names, and unknown keys now fail the same loud, uniform way — no per-name rename narrative, nothing project-specific in the framework.

Single authority for the valid set: ContextScopeDict carried a dead keep (no runtime consumer, no YAML uses it as a directive — only as a field ref like aggregate_votes.keep) and lacked drops. Aligned it to the registry and removed the dead keep read in the docs parser.

Design decisions

• Message tells you what to use, not what changed. The old rename map only ever helped the one project with unmigrated seed_path: configs — a backward-compat shim. Every wrong name now gets the same generic "not a valid directive. Valid directives: …" line.
• Single-authority reconciliation (DIRECTIVE_REGISTRY is the truth), not registry-only, so the type stops lying.

Verification

• RED: 4 tests fail on main — 2 inverted (test_handles_unknown_directives asserted the silent pass-through; TestRemovedDirectives asserted the rename hint) + 2 new (observ typo, unknown key). Genuine assertion failures.
• GREEN: full suite 8113 passed; ruff + mypy clean.
• Blind review (fresh context, diff + bug only): YES — root cause fixed, all five valid directives still accept, keep field-refs untouched, valid-set can't drift (it is sorted(DIRECTIVE_REGISTRY)), and workflow_static_analyzer.py already catches the ConfigurationError and maps it to StaticTypeError.
• Real project (agac inspect -a ql_domc through the actual loader, not a unit dict):

  Error: Configuration Error: Invalid configuration in agent 'ql_domc'
    Problem: context_scope.seed_path is not a valid directive. Valid directives: drop, drops, observe, passthrough, seed.
  

  Loud, lists the valid set, no rename story, exit 1.
• Smoke: skipped — scan-project canary divergence is pre-existing (baseline.sh confirms it fails on main too; stale project action registry, unrelated to directive validation). Filed as a separate follow-up.

Notes

• Test inversion (not test-weakening): the 7 removed test-assert lines are the two tests that encoded the old behavior (silent pass-through + rename hint), flipped to assert the loud generic error.
• Consequence, not a hint: the qanalabs workflows using seed_path: (8+) now get the generic error — they already failed on main via the old map. Migrating them seed_path:→seed: is a separate change in the qanalabs repo; the framework carries no per-user migration text.