feat: in-process embedded permissions and per-schema-version caching

[josephschorr]

Summary

Adds the ability to embed SpiceDB's permission engine in-process (no gRPC server) and makes per-schema-version caching of derived artifacts possible, eliminating repeated work on the check hot path.

Changes

• datalayer: cache schema-derived artifacts on the stored-schema cache. The stored-schema cache already shares one instance per schema version (keyed by schema hash). Bundle lazily-built, schema-derived caches (compiled caveats today; type systems / reachability later) into that instance via a new CachedSchema type, so they share the schema's lifetime and are discarded, together, when the schema changes. Register a kind with RegisterDerivedCache; retrieve the per-schema instance with GetDerivedCache. The stored-schema cache now holds *datalayer.CachedSchema; pkg/datastore is unchanged.

• datastore: honor schema mode when writing bootstrap data. NewDatastore's bootstrap always wrote schema in legacy per-definition form regardless of the configured schema mode, so a server reading from the unified schema would find none. Adds a BootstrapSchemaMode option; the zero value preserves prior behavior.

• caveats: cache compiled caveats per schema version. ComputeCheck constructs a fresh CaveatRunner per call, so its per-runner deserialized-caveat cache never persists across checks. Deserializing a caveat rebuilds its CEL environment, which is expensive and — with a rich caveat type set — dominated check cost. This caches compiled caveats on the schema-derived cache, keyed by caveat name, so the CEL environment is built once per schema version rather than once per check. Falls back to per-runner caching when the reader is not backed by a unified stored schema.

• embedded: add in-process permissions library. Adds pkg/embedded, a focused library for running permission checks in-process against a datastore via the dispatch engine — no gRPC, caveat context passed as native Go values. Includes a README and tests.

Testing

• mage lint:all passes; unit suite passes.
• New tests: pkg/datalayer (derived-cache registry: lazy build, per-schema isolation, duplicate/unregistered handling), internal/caveats (compiled-caveat cache), pkg/embedded (checks across both legacy and unified schema modes, incl. caveated/conditional results).

[codecov]

Codecov Report

❌ Patch coverage is 85.38012% with 25 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
pkg/embedded/permissions.go	85.72%	8 Missing and 4 partials ⚠️
pkg/datalayer/derivedcache.go	85.19%	3 Missing and 1 partial ⚠️
internal/caveats/run.go	85.72%	2 Missing and 1 partial ⚠️
internal/caveats/schemacache.go	81.25%	2 Missing and 1 partial ⚠️
pkg/datalayer/schema_adapter.go	80.00%	2 Missing and 1 partial ⚠️

📢 Thoughts on this report? Let us know!