[Bug] Admission validation silently accepts a nonexistent provider function in CUE templates

Is there an existing issue for this?

• I have searched the existing issues

Affected area

CUE templating

KubeVela version

master @ ec091a557 (v1.11.0 branch)

Kubernetes version and distribution

Not required to reproduce this is a compile-time CUE check with no cluster interaction (verified via unit test; reproducible on any cluster running the webhook, e.g. v1.28+, EKS/kind/etc

Describe the bug

Admission validation for ComponentDefinition, TraitDefinition, and WorkflowStepDefinition CUE templates does not catch a selector into a nonexistent function on a real, correctly-imported provider package. For example, kube.#NotARealFunction (there is no such function in vela/kube) or op.#NotReal (no such function in vela/op) both pass admission with no error, even though the definition can never work

This might be happening beacause cue.Value.Validate() which pkg/webhook/utils/utils.go's shared validateCuexTemplateWith calls does not surface a bottom rooted only in incomplete concreteness by default, and neither does val.Err(). The bad selector's error only surfaces if you additionally call Validate(cue.Concrete(true)), but that isn't a safe blanket fix either: it also rejects every legitimately unfilled parameter field, which is how virtually every real definition is written (parameters are only concrete once an Application supplies them at render time)

To reproduce

1. Apply a WorkflowStepDefinition (or ComponentDefinition/TraitDefinition) whose CUE template imports a real provider package but calls a function that doesn't exist in it:

kind: WorkflowStepDefinition
metadata:
  name: broken-step
  namespace: vela-system
spec:
  schematic:
    cue:
      template: |
        import "vela/kube"
        output: kube.#NotARealFunction & {
          $params: {}
        }

1. The webhook admits it with no error or warning.
2. Any Application that runs this step will fail at execution time instead, with a much less obvious error than an admission-time rejection would have given

Expected behavior

Step 1 should be rejected at admission with a clear message like undefined provider function, since kube.#NotARealFunction can never resolve regardless of what parameters an Application supplies

Screenshots or logs

Additional context

No response