feat: add CUE version compatibility upgrade engine (cue/upgrade)

Introduces the cue/upgrade package that transparently rewrites legacy CUE
syntax (pre-v1.11 KubeVela definitions) at render time so that existing
stored definitions continue to work against CUE v0.14+.

Three upgrade rules are implemented:

1. list-arithmetic (upgrade_1_11.go)
   - `list + list` → `list.Concat([list, list])`
   - `list * n` → `list.Repeat(list, n)`
   Handles context.* chains (e.g. context.output.spec.template.spec.containers)
   and parameter.* selectors with defaulted list types.

2. error-field-label (upgrade_1_11.go)
   - Unquoted `error:` field label → `"error":`

3. bool-default-negation (upgrade_bool_default.go)
   - `_flag: bool | *false` + `if !_flag` guard pattern →
     direct CUE expression without the hidden bool field

Also provides:
- EnsureCueVersionCompatibility / RequiresUpgrade public API (upgrade.go)
- EnableCUEVersionCompatibility feature flag
- LRU result cache (cache.go) for repeated evaluations of the same template
- Comprehensive test coverage including edge cases for selector chains

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Signed-off-by: Brian Kane <briankane1@gmail.com>

Author: briankane

cue/upgrade/cache.go

@@ -0,0 +1,199 @@
+/*
+/*
+Copyright 2026 The KubeVela Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package upgrade
+
+import (
+	"container/list"
+	"context"
+	"crypto/sha256"
+	"fmt"
+	"sync"
+	"sync/atomic"
+	"time"
+)
+
+// CompatibilityCacheSize is the maximum number of cache entries. Default 2000.
+// Overridden at startup via --cue-compatibility-cache-size.
+var CompatibilityCacheSize = 2000
+
+// compatCache stores the result of each template compatibility check, keyed by SHA-256 of the raw template.
+var compatCache atomic.Pointer[lruCache]
+
+// compatCacheCancel cancels the eviction goroutine of the current compatCache instance.
+var compatCacheCancel context.CancelFunc
+
+// compatCacheMu serialises concurrent calls to InitCompatibilityCache.
+var compatCacheMu sync.Mutex
+
+func init() {
+	c := newLRUCache(CompatibilityCacheSize)
+	c.startEvictionLoop(context.Background())
+	compatCache.Store(c)
+}
+
+// CacheEntryTTL is how long an unaccessed entry lives before being swept.
+var CacheEntryTTL = 1 * time.Hour
+
+// InitCompatibilityCache reinitialises the cache with the given size and starts background TTL eviction.
+// Safe to call multiple times (e.g. in tests): the previous eviction goroutine is stopped first.
+func InitCompatibilityCache(ctx context.Context, size int) {
+	if size < 0 {
+		size = 0
+	}
+	compatCacheMu.Lock()
+	defer compatCacheMu.Unlock()
+	if compatCacheCancel != nil {
+		compatCacheCancel()
+	}
+	CompatibilityCacheSize = size
+	c := newLRUCache(CompatibilityCacheSize)
+	if size > 0 {
+		cacheCtx, cancel := context.WithCancel(ctx)
+		compatCacheCancel = cancel
+		c.startEvictionLoop(cacheCtx)
+	} else {
+		compatCacheCancel = nil
+	}
+	compatCache.Store(c)
+}
+
+// templateHash returns the SHA-256 hex digest of s, used as the cache key.
+func templateHash(s string) string {
+	sum := sha256.Sum256([]byte(s))
+	return fmt.Sprintf("%x", sum)
+}
+
+// compatEntry is the cached result for a single template.
+// upgraded always holds the normalised (and possibly semantically rewritten) template.
+// requiresUpgrade is true only when semantic fixes were applied.
+type compatEntry struct {
+	requiresUpgrade bool
+	upgraded        string
+}
+
+// lruCache is a goroutine-safe LRU cache with TTL eviction.
+type lruCache struct {
+	mu       sync.Mutex
+	capacity int
+	ll       *list.List
+	items    map[string]*list.Element
+}
+
+type lruEntry struct {
+	key        string
+	value      compatEntry
+	lastAccess time.Time
+}
+
+func newLRUCache(capacity int) *lruCache {
+	return &lruCache{
+		capacity: capacity,
+		ll:       list.New(),
+		items:    make(map[string]*list.Element, capacity),
+	}
+}
+
+func (c *lruCache) startEvictionLoop(ctx context.Context) {
+	interval := CacheEntryTTL / 2
+	if interval <= 0 {
+		return
+	}
+	go func() {
+		ticker := time.NewTicker(interval)
+		defer ticker.Stop()
+		for {
+			select {
+			case <-ctx.Done():
+				return
+			case <-ticker.C:
+				c.evictStale()
+			}
+		}
+	}()
+}
+
+func (c *lruCache) evictStale() {
+	c.mu.Lock()
+	now := time.Now()
+	evicted := 0
+	for key, el := range c.items {
+		if now.Sub(el.Value.(*lruEntry).lastAccess) > CacheEntryTTL {
+			c.ll.Remove(el)
+			delete(c.items, key)
+			evicted++
+		}
+	}
+	c.mu.Unlock()
+	if evicted > 0 {
+		if fn := OnCacheEviction; fn != nil {
+			for range evicted {
+				fn("ttl")
+			}
+		}
+	}
+}
+
+func (c *lruCache) get(key string) (compatEntry, bool) {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	el, ok := c.items[key]
+	if !ok {
+		return compatEntry{}, false
+	}
+	entry := el.Value.(*lruEntry)
+	entry.lastAccess = time.Now()
+	c.ll.MoveToFront(el)
+	return entry.value, true
+}
+
+func (c *lruCache) put(key string, value compatEntry) {
+	if c.capacity <= 0 {
+		return
+	}
+	c.mu.Lock()
+	if el, ok := c.items[key]; ok {
+		entry := el.Value.(*lruEntry)
+		entry.value = value
+		entry.lastAccess = time.Now()
+		c.ll.MoveToFront(el)
+		c.mu.Unlock()
+		return
+	}
+	evicted := false
+	if c.ll.Len() >= c.capacity {
+		oldest := c.ll.Back()
+		if oldest != nil {
+			c.ll.Remove(oldest)
+			delete(c.items, oldest.Value.(*lruEntry).key)
+			evicted = true
+		}
+	}
+	el := c.ll.PushFront(&lruEntry{key: key, value: value, lastAccess: time.Now()})
+	c.items[key] = el
+	c.mu.Unlock()
+	if evicted {
+		if fn := OnCacheEviction; fn != nil {
+			fn("capacity")
+		}
+	}
+}
+
+func (c *lruCache) len() int {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	return c.ll.Len()
+}