refactor(idp): use UEG for service dependency helpers - #827

Summary

Move pup idp deps and the dependency section of pup idp assist from the legacy production dependency endpoint to the Unified Entity Graph (UEG).

Both helpers now return runtime service relationships observed during the past hour. Use pup idp entities query for other lookbacks or broader graph relationships.

Changes

• Query services by exact UEG reference.
• Expand runtime upstream and downstream service relationships in the same UEG request.
• Keep the existing deps and assist output shapes.
• Sort and deduplicate dependency names, and return a clear error when the service is missing.
• Update command help, service-catalog guidance, and the dd-idp skill to explain the new behavior.
• Remove the old hard-coded env=prod dependency flow.

Testing

• cargo fmt --all -- --check
• cargo clippy --all-targets -- -D warnings
• cargo test: 2,008 passed; two known host-specific tests skipped
• cargo test skills::: 89 passed
• Official dd-idp skill validator
• WASI release build and browser-WASM library build
• Live read-only smoke tests against the isolated staging OAuth profile:
  • idp deps catalog-http
  • idp assist catalog-http
  • direct UEG control query with the same one-hour runtime relations
  • missing-service error path

The helper and direct UEG query returned the same 14 downstream services for catalog-http.

Notes

This PR does not change dependencies. cargo audit --no-fetch still reports the existing h2, rustls, and rsa advisories from main.