[BUG] — Dubbo & Sofa reference caches: `key.contains(id)` substring invalidation → mass spurious rebuilds + O(n) full scan per event

- severity: Medium-High
- files: `shenyu-plugin-.../apache-dubbo/.../cache/ApacheDubboConfigCache.java:531-536` (`invalidateWithSelectorId`), `:543-548` (`invalidateWithRuleId`), `:555-560` (`invalidateWithMetadataId`); `.../sofa/.../cache/ApplicationConfigCache.java:436-467`
- description: Cache keys are composite `namespace_selectorId_ruleId_metaDataId_protocol__version_group`. Invalidation matches `key.contains(id)` as a *substring*; a short numeric/UUID id (or common hex chars in the md5 segment) can legitimately match unrelated keys. Each spurious invalidation triggers `cache.invalidate` → `removalListener` → `config.destroy()`, so the next request forces a full `reference.get()`/`refer()` rebuild (expensive registry connect) on the request hot path. Worst case (id `1`, `0`) → mass invalidation. Also an O(n) full scan of `cache.asMap().keySet()` on every sync event.
- impact: Sync event → request hot-path rebuild storm; event-loop stalls during registry reconnect (see PERF-51).
- suggested_fix: Invalidate by exact composite-key segment (split key on separator and compare the specific segment), or maintain a secondary index `id -> Set` for O(1) exact invalidation.
- confidence: High

---
_Identified during the 2026-08-02 deep re-scan; full list in [`docs/scan2-2026-08-02/06-medium-tiers.md`](docs/scan2-2026-08-02/06-medium-tiers.md)._

Start with invalidateWithSelectorId, invalidateWithRuleId, and invalidateWithMetadataId in ApacheDubboConfigCache.java, then compare the corresponding logic in ApplicationConfigCache.java. Trace the composite cache-key format and sync-event path before choosing exact segment matching or a secondary index. Done means unrelated keys remain valid, invalidation avoids the full key scan, and affected references rebuild only when their own identifiers match.

Written by the indexing model from the issue text.