Task: Avoid double IdP catalog fetch in policy-conflict check (#154)

Context

Follow-up from a review nit on rossoctl/cortex#809 (pre-commit policy conflict diagnostic).

check_policy_conflicts (aiac/src/aiac/agent/uc/policy_check/check.py) calls
config.get_services() to derive service_type, and then resolve_focal_entities
(aiac/src/aiac/agent/shared/focal_entities.py) calls config.get_services() again
internally. That is two IdP catalog round-trips per check request where one would do.

Why it wasn't folded into rossoctl/cortex#809

resolve_focal_entities is shared with the live /apply builder path, and its docstring
deliberately forbids deriving service_type from focus.type (the caller routes on the
passed-in type to preserve the /apply contract). So the fix must not move the type lookup
into the resolver.

Proposed fix

Add an optional pre-fetched services parameter to resolve_focal_entities and thread the
already-fetched list through from check_policy_conflicts, keeping the /apply contract
byte-for-byte. (Caching the catalog on Configuration is an alternative, but the explicit
param keeps the seam obvious and testable.)

Acceptance

• Single get_services() call per POST /policy/check request.
• Live /apply path and its 422 contract unchanged.
• A test asserts the catalog call count (none currently does — noted in review).

Assisted-By: Claude (Anthropic AI) noreply@anthropic.com

Start with aiac/src/aiac/agent/uc/policy_check/check.py and aiac/src/aiac/agent/shared/focal_entities.py, tracing the policy check and live /apply callers before running the relevant tests. Done means POST /policy/check makes one get_services() call, the catalog call count is covered by a test, and the live /apply path and its 422 contract remain unchanged.