fix: require an exact-match key field for update/delete document

[federico-martinez-invgate]

Problem

updateDocument / deleteDocument accepted any field as key_field and ran
delete_term(Term::from_field_text(field, value)) with no check that the field is a non-tokenized
exact key. Passing a tokenized text field (or a STORED-only attribute) silently corrupted the
index:

• update → duplication: a multi-word value is never stored as a single term, so delete_term
  matches nothing, the delete is a no-op, and the add creates a duplicate document for the key.
• delete → mass deletion: a value that is an indexed token deletes every document containing
  that token, not one.

Fix

• field_is_exact_key() in schema.rs: a field is a valid key iff it's a STRING str field —
  indexed with the "raw" tokenizer (STRING uses "raw", TEXT uses "default", attributes have no
  indexing options). This rejects both tokenized text fields and non-indexed attribute fields.
• resolve_key_field() guard in writer.rs, called by both delete_by_id and update_document,
  which returns a clear error before any writer mutation. The existing "field does not exist"
  path is preserved. Plain TantivyException in PHP (no new exception type) — this is a programmer
  error, not a runtime-recoverable condition.

Tests

Two new tests reproduce both corruption modes against the old behavior (update → 2 copies;
delete → 0 docs) and now assert the operations are rejected without corrupting the index. Full suite:
20/20 pass (17 core + 3 ext), clippy -D warnings and fmt --check clean.

Real-product validation

Audited service-desk-main before merge: the only updateDocument/deleteDocument call-sites (the
write feed) derive key_field from tantivyIdField() = id_key / doc_key, both in the keys
bucket for all three indexes (Incidents / KnowledgeBase / CatalogCategories). Ran the real engine:
update-by-key leaves no duplicate, delete-by-key removes only the target (including composite
doc_key), and the negative cases (tokenized/attribute key) throw the expected exception. No
call-sites need changes.

🤖 Generated with Claude Code