Draft: feat(ontology): ontology improvements from the 2026-10 audit [skip ci]

What does this MR do and why?

We audited the GitLab data in the lake against what Orbit could answer. This MR adds what was missing: dependencies per project, Duo workflow runs, custom roles, AI Catalog items, and about 90 fields and 18 edges on the nodes we already have. It also fixes two wrong answers.

How it works

Two wrong answers are fixed.

Orbit question	Before	After
Which work items does this MR close?	also every work item the MR only mentions	only the ones it closes (edge)
Who approved this MR?	most approvers were missing	every approver

The approver bug came from two pipelines that wrote the same edge, one of them without the user tags. We removed the bad writer and added a rule so it cannot happen again: a tag on an edge is allowed only when every pipeline that writes the edge fills it (test).

New questions Orbit can answer.

You can ask	New in the ontology
Which projects use lodash, and which version?	SbomOccurrence (node)
Which Duo workflows ran on this project?	DuoWorkflow
Who holds this custom role?	MemberRole
Which agents does this project maintain?	DuoCatalogItem
Which in-progress issues have no assignee? How long did this job wait?	about 90 fields on existing nodes
Which pipeline first found this vulnerability? Who reacted to this issue?	18 edges, such as FIRST_DETECTED_IN and AWARDED
Why did this job fail?	12 new failure reasons, and four text fields become enums

Each new node has its own GitLab permission check, added by the merged Rails MR Add five Orbit redaction resource types. We checked every field on the data lake, and against the REST API so we expose nothing GitLab hides. The full list is in the audit snippet.

Known limits

• Todo comes in the next MR, stacked on this one, because it needs owner scope.
• The first edge properties come after the edge-property MR merges.
• The schema ledger test fails until the bump. The bump is added after the edge-property MR merges, and it is a full rebuild.

Related Issues

Closes #1439

Related to #1379. Stacked on !3239 (closed) (owner scope), which sits on !3230 (closed).

Testing

• Ontology unit tests and 30 new indexer scenarios pass, as do the full SDLC and data-correctness suites.
• On a GDK stack, every new edge and field returns rows, and each test user sees only what GitLab allows.

Performance Analysis

Every new or changed extract ran one page on the production data lake at the largest group. New fields add at most 1.46 times the bytes per row. Some extracts got much cheaper, because they now read in the order the lake stores the data. Details are in the measurements snippet.

Extract page	Before	After
HAS_LABEL, first page	21.5 M rows, 1,158 MiB	0.79 M rows, 43 MiB
MergeRequest, 50,000 rows	4.45 M rows read	1.88 M rows read

• This merge request does not introduce any performance regression.

Agent context: scope decisions, exclusions, rig counts

Scope decisions, exclusions, extract notes, and the e2e rig counts are in mr-3196-notes.md of the measurements snippet.