direct: reject variable references in resource map keys

[SAY-5]

Changes

When a resource is keyed by a variable reference (e.g. resources.schemas.${var.schema}), the literal ${var.foo} survives the plan-time walk in bundle/direct/bundle_plan.go. The string is then re-parsed by dyn.NewPathFromString, which splits on . and produces a non-existent path. Root.GetResourceConfig returns (nil, nil) for that path, and the resulting nil *resources.Schema is dereferenced inside PrepareState (bundle/direct/dresources/schema.go:22), panicking with a nil pointer.

This change detects variable references in resource map keys during the MapByPattern walk in makePlan and returns an actionable error instead of crashing.

Why

Closes #5098. The user expected either correct interpolation or a clear error; either way, panicking is wrong. Variable interpolation only applies to values, not to map keys, so the only correct behavior here is a validation error pointing at the offending key. Matches the CLAUDE.md rules "Reject incompatible inputs early with an actionable error" and "Where a panic is genuinely possible, validate at the entry point and return an error."

Tests

• New regression test TestMakePlanRejectsVariableInResourceKey in bundle/direct/bundle_plan_test.go reproduces the issue's YAML scenario and asserts a clear error message instead of a panic. Without the fix, this test panics with the exact stack trace from the issue (schema.go:22 nil deref); with the fix it returns resource key "resources.schemas.${var.schema}" cannot contain variable references; use a literal key and parameterize fields like 'name' instead.
• go build ./...
• go test ./bundle/... -timeout 120s passes (unrelated TestClearWorkspaceClient requires ~/.databrickscfg and fails on main too).

[github-actions]

An authorized user can trigger integration tests manually by following the instructions below:

Trigger:
go/deco-tests-run/cli

Inputs:

• PR number: 5164
• Commit SHA: a99e58637bb4fdce1cdbbbe226ad00dfe23f1fc6

Checks will be approved automatically on success.

[github-actions]

Waiting for approval

Based on git history, these people are best suited to review:

• @denik -- recent work in bundle/direct/

Eligible reviewers: @andrewnester, @anton-107, @janniklasrose, @lennartkats-db, @pietern, @shreyas-goenka

_{Suggestions based on git history. See OWNERS for ownership rules.}