Function validate_identity_expr 

pub fn validate_identity_expr(expr: &str) -> ValidationResult

Validate a Repository/ClusterRepository identityDefaults CEL expression at admission (ADR-0004 §5): it must compile, and — because CEL reports an out-of-scope variable only at evaluation time — it must also evaluate against a representative context without referencing an undeclared variable. A non-string result is rejected. Missing map keys (e.g. labels['env'] when the trial data lacks env) are tolerated: they are data-dependent, not a structural error.