bug: reject unsupported decision-rule operators during config validation

Audited upstream baseline (2026-07-15)

Decision rules use a RuleNode tree. In src/semantic-router/pkg/classification/classifier_composers.go, runtime evaluation handles OR and unary NOT; every other value, including an omitted operator and typos such as XOR or ADN, falls through to AND semantics.

The config validation path in src/semantic-router/pkg/config/validator_decision.go validates model, algorithm, workflow, output, and plugin contracts but does not reject unsupported rule-tree operators. The DSL emits the supported operators, but hand-written YAML can still load an invalid non-empty value.

Expected behavior

• An omitted operator keeps the documented AND default.
• A non-empty operator must be AND, OR, or NOT (case handling should match the documented config contract).
• NOT must have exactly one child.
• Invalid operators fail config validation before runtime.

Acceptance criteria

• File and Kubernetes/canonical config paths enforce the same rule.
• Errors include the decision name and rule-tree location.
• Tests cover omitted/AND/OR/NOT, invalid values, nested nodes, and NOT arity.
• Runtime and validation share or demonstrably agree on the supported operator set.
• Maintained examples and DSL output continue to validate.

Relevant surfaces

src/semantic-router/pkg/config/validator_decision.go, src/semantic-router/pkg/classification/classifier_composers.go, DSL compilation, reference config, and tests.