Follow-up extracted from #1061. Raw authored steps can still reach Step::RawYaml; add a strict validation path for isolated untrusted fragments using the current typed task parsers and lint findings. Define accepted shapes, reject unsafe or ambiguous input, and add compile/lint contract tests.
Follow-up extracted from #1061. Raw authored steps can still reach
Step::RawYaml; add a strict validation path for isolated untrusted fragments using the current typed task parsers and lint findings. Define accepted shapes, reject unsafe or ambiguous input, and add compile/lint contract tests.