config: enforce version and unknown-field parity across all producers

Summary

Define one supported-version and unknown-field contract across the Go router, Python CLI, dashboard, DSL, dynamic CRDs, and operator. Owner surfaces: src/semantic-router/pkg/config/canonical_config.go, src/semantic-router/pkg/config/loader.go, src/vllm-sr/cli/config_contract.py, src/vllm-sr/cli/models.py, src/vllm-sr/cli/parser.py, and deploy/operator/controllers/canonical_config_builder.go.

Current behavior

Canonical input can be interpreted without an explicit supported-version gate, and maintained producers disagree on whether nested unknown fields are rejected, ignored, or preserved. A document accepted by one control plane can therefore change meaning in another.

Expected behavior

Supported versions are checked before interpretation, unknown fields are rejected outside named extension seams, migrations are explicit, and every maintained producer agrees on acceptance, diagnostics, and normalized output.

Acceptance

• Centrally own supported versions and reject missing, malformed, old-without-migration, and future versions before parsing or normalization.
• Reject unknown fields with stable field-path diagnostics at user and control-plane boundaries.
• Keep schemaless objects only at named extension seams with an owner validator.
• Add one cross-language golden corpus for versions, nested unknown fields, migrations, and normalized output.
• Derive or test operator and CLI constants against the same contract.

Validation

• Run cd src/semantic-router && go test ./pkg/config ./pkg/dsl ./pkg/k8s.
• Run cd deploy/operator && go test ./api/v1alpha1 ./controllers.
• Run cd src/vllm-sr && python -m pytest tests.
• Execute the same golden corpus through Go, CLI, dashboard, DSL, both CRD paths, and operator output in CI.

Related

• Parent audit: #2375
• Versioned mutation design: #2326
• Operator parity: #2355
• Decision AST validation: #2122