#516 feat: giga-swamp phase 4 — CEL cross-namespace queries

Problem

Phases 1-3 established the namespace infrastructure: value object, catalog schema v4, namespace-prefixed filesystem layout, repo-local catalog, and per-namespace locking. Data is written to the correct namespaced paths with correct catalog stamps. But users cannot yet query across namespaces — every CEL expression ignores the namespace dimension.

Proposed Solution

1. Model resolver namespace routing

Update src/domain/expressions/model_resolver.ts so data.latest(), data.version(), data.findBySpec() and other point-lookup methods call parseNamespacedModelName() to detect the namespace prefix syntax:

• No prefix (data.latest('scanner', 'result')) — own namespace only (default scope)
• Specific namespace (data.latest('security:scanner', 'result')) — target that namespace
• Wildcard (data.latest('*:scanner', 'result')) — all namespaces, errors if ambiguous (model exists in multiple namespaces)

The ambiguity error must be clear: 'ambiguous: scanner exists in namespaces [infra, security], qualify with namespace prefix'.

2. Query service namespace predicates

Update src/domain/data/data_query_service.ts to expose namespace as a filterable field in CEL predicates:

• data.query("namespace == 'security'") — filter to specific namespace
• data.query("namespace == 'security' && modelName == 'scanner'") — combine with other predicates
• data.query("modelType == 'aws/ec2/vpc'") — no namespace predicate spans all namespaces

3. Data access service

Update src/domain/data/data_access_service.ts to parse namespace:model syntax in model name arguments and route cross-namespace reads through the appropriate namespace.

Critical constraints

• Solo mode expressions MUST produce byte-identical results. Not functionally equivalent — byte-identical. Any expression that works today must return the same data in the same order.
• The colon (:) is not legal in model names today. The parser must not introduce ambiguity with existing expressions.
• The wildcard (*) is not legal in model names today. Same constraint.
• Do NOT change the filesystem layout, catalog schema, path resolver, or locking — those are done (Phases 1-3).
• Do NOT add CLI output columns or namespace commands — that is Phase 5.

Ship Gate

• deno check, deno lint, deno fmt, deno run test all pass
• Solo mode regression gate: every existing CEL expression produces byte-identical results
• Cross-namespace point lookup: data.latest('ns:model', 'name') returns the correct namespace's data
• Wildcard lookup: data.latest('*:model', 'name') returns data when unambiguous, errors when ambiguous
• Namespace predicate: data.query("namespace == 'x'") filters correctly
• No-namespace predicate: data.query("modelType == 'y'") spans all namespaces
• Compile binary with deno run compile and smoke test existing CEL expressions against a real repo

Design Context

Full design doc: resources/giga-swamp.md (see Query Layer and Design Decisions sections)

This is Phase 4 of 7. Depends on Phases 1-3 (all shipped). This is the highest-risk phase — CEL is the most sensitive part of swamp. The model resolver is the hot path for every CEL expression in every workflow and CLI query command.