#3533 Align the DAG schema with the parser

Problem

internal/cmn/schema/dag.schema.json drives the editor, MCP previews, and dagu schema. It had drifted from the DAG parser in both directions, so the same YAML got different verdicts:

YAML	Parser (dagu validate)	Schema before
top-level wait_mail	accepts	rejects (root additionalProperties: false)
mail_on.wait	accepts	missing
smtp.oauth	accepts	missing
tool package digest	accepts	rejects
llm.tools, llm.max_tool_iterations	accepts	rejects
DAG-level redis.tls_ca / tls_cert / tls_key	rejects ('redis' has invalid keys)	accepts
step worker_selector: local	rejects (decoding fails)	accepts

The schema also said an omitted standard registry uses a pinned commit, but Dagu resolves the latest release (registryref.go).

Change

• Add wait_mail, mail_on.wait, tool package digest (sha256:<64 hex>, any case, as normalizeToolDigest accepts), and DAG-level llm.tools and llm.max_tool_iterations.
• Add smtp.oauth as a new smtpOAuth definition. It mirrors oauthconfig.ValidateStructure: providers microsoft, google_service_account, google_refresh, each with its required (non-blank) and rejected fields. With oauth, smtp.username must be non-blank and smtp.password must be absent, as the parser requires.
• Tool shorthand accepts an optional #sha256:<64 hex> suffix and nothing else after #, and @latest stays rejected with a digest.
• Exclude tls_ca, tls_cert, tls_key from DAG-level redis; spec 057 and spec 003 list them as step with fields.
• Remove the step-level "local" form of worker_selector. It was added to the schema in #1642, but the step parser only takes a label map.
• Describe the registry default as the latest release of the standard aqua registry.

schemas/dag.schema.json is a symlink to the embedded schema, so there is no second copy to update.

Testing

• New TestDAGSchemaAgreesWithParser runs each sample through both the schema and spec.LoadYAML, with built-in actions registered, and asserts that both accept or both reject it. Its schema cases fail on main.
• go test ./internal/cmn/schema/... passes.

Summary by CodeRabbit

• New Features
  • Package references can include a SHA-256 digest, and package objects can declare one for artifact verification.
  • SMTP notifications support OAuth with provider-specific credentials, and mail notifications support a wait trigger.
  • LLM configuration supports tool DAGs and a configurable maximum number of tool iterations.
  • Omitted Aqua registry references resolve to the latest standard-registry release.
• Configuration
  • SMTP OAuth requires a nonblank username and valid provider-specific credentials, and cannot be combined with a nonblank password.
  • Redis TLS options are restricted, and worker selectors accept label maps only; the "local" selector is no longer accepted.
  • @latest package references and maximum tool-iteration values below 1 are rejected.