fix(controlplane): exempt batch-local policy refs in contract apply

app/controlplane/api/controlplane/v1/workflow_contract.proto

@@ -121,6 +121,12 @@ message WorkflowContractServiceApplyRequest {
   bytes raw_schema = 1;
   // When true, validate and compute the result without persisting any change
   bool dry_run = 2;
+  // Names of policies created/updated in the same batch apply. References to these are
+  // treated as known instead of being resolved against the registry (they may not be
+  // persisted yet, e.g. during dry-run). Remote references are still validated.
+  repeated string batch_policy_names = 3;
+  // Same as batch_policy_names, for policy groups created/updated in the same batch.
+  repeated string batch_policy_group_names = 4;
 }
 
 message WorkflowContractServiceApplyResponse {

app/controlplane/internal/service/attestation.go

@@ -785,7 +785,7 @@ func (s *AttestationService) FindOrCreateWorkflow(ctx context.Context, req *cpAP
 
 	// contract validation
 	if req.GetContractBytes() != nil {
-		if err = s.workflowContractUseCase.ValidateContractPolicies(ctx, req.GetContractBytes(), token); err != nil {
+		if err = s.workflowContractUseCase.ValidateContractPolicies(ctx, req.GetContractBytes(), token, nil, nil); err != nil {
 			return nil, handleUseCaseErr(err, s.log)
 		}
 	}

app/controlplane/internal/service/workflowcontract.go

@@ -146,7 +146,7 @@ func (s *WorkflowContractService) Create(ctx context.Context, req *pb.WorkflowCo
 	}
 
 	if len(req.RawContract) != 0 {
-		if err = s.contractUseCase.ValidateContractPolicies(ctx, req.RawContract, token); err != nil {
+		if err = s.contractUseCase.ValidateContractPolicies(ctx, req.RawContract, token, nil, nil); err != nil {
 			return nil, handleUseCaseErr(err, s.log)
 		}
 	}
@@ -212,7 +212,7 @@ func (s *WorkflowContractService) Update(ctx context.Context, req *pb.WorkflowCo
 
 	// Validate the contract policies if the raw contract is provided
 	if len(req.RawContract) != 0 {
-		if err = s.contractUseCase.ValidateContractPolicies(ctx, req.RawContract, token); err != nil {
+		if err = s.contractUseCase.ValidateContractPolicies(ctx, req.RawContract, token, nil, nil); err != nil {
 			return nil, handleUseCaseErr(err, s.log)
 		}
 	}
@@ -253,7 +253,16 @@ func (s *WorkflowContractService) Apply(ctx context.Context, req *pb.WorkflowCon
 		return nil, err
 	}
 
-	if err = s.contractUseCase.ValidateContractPolicies(ctx, req.RawSchema, token); err != nil {
+	// Batch-local references are only exempted from registry resolution on a dry-run, where
+	// the resources may not be persisted yet. A real apply persists batch resources before the
+	// contract, so it must always validate fully and never trust the client-supplied batch lists.
+	var batchPolicyNames, batchPolicyGroupNames []string
+	if dryRun {
+		batchPolicyNames = req.GetBatchPolicyNames()
+		batchPolicyGroupNames = req.GetBatchPolicyGroupNames()
+	}
+
+	if err = s.contractUseCase.ValidateContractPolicies(ctx, req.RawSchema, token, batchPolicyNames, batchPolicyGroupNames); err != nil {
 		return nil, handleUseCaseErr(err, s.log)
 	}