feat: reference an out-of-repo module in a workspace (#350)

[antoinetoussaint-byte]

Closes#350.

Summary

• The model layer already carried most of what the issue asked for: a workspace module reference has a path: override (ModuleReference.PathOverride), Workspace.ModulePath resolves it, and LoadModules/LoadServices load a referenced module's services into the run/render graph the same as in-repo ones. Cross-boundary endpoint/dependency wiring (ValidateServiceDependencies) already works on whatever the reference resolves to.
• The one gap: relative overrides were confined by filepath.IsLocal, so only a non-portable absolute path could point out-of-repo. A composition-root workspace committed to git needs a portable relative reference to a sibling checkout (path: ../module-saas-starter) — which was rejected.
• This lifts that restriction for module references only (they are the composition root; absolute overrides were already treated as a deliberate external-location choice). Service/job/application overrides stay confined to their owning resource, and NUL/backslash stay rejected as cross-platform hazards. No vendoring, no fork boundary.

Workspace.ModulePath joins a relative override onto the workspace dir (path.Join(workspace.Dir(), override)), and LoadWorkspaceFromDir resolves the workspace dir to an absolute path up front — so path: ../host resolves relative to the workspace root regardless of the invocation cwd. That cwd-independence is what makes the relative form committable and portable across machines.

External git/OCI sources remain future work, as the issue scopes them ("and later an external git/OCI source"); this delivers the path-reference form.

Test plan

• go test ./resources/... ./architecture/... (module-layout + path-boundary suites) pass
• End-to-end test: a layout: modules workspace referencing an out-of-repo module via path: ../host loads the sibling module's services and validates a cross-boundary service dependency on its public endpoint. Asserts the committed override is the relative form (../host), not an absolute machine path — the portability property is the point.
• Validator test: module reference accepts ../host, still rejects NUL/backslash; service reference override still rejects ../ traversal
• go build ./..., go vet ./resources/, gofmt clean

🤖 Generated with Claude Code