Add a check that every Canvas entity reference in the default content resolves to a shipped entity

Problem/Motivation

Nothing validates that the entity references in the recipe's default content actually resolve to entities the recipe ships. A Canvas component input can carry a CANVAS_ENTITY_REFERENCE to a media or file uuid, and a _meta.depends block can name one, without anything checking that the target is present in content/.

When a reference does dangle, entityRepository::loadEntityByUuid() returns NULL and Canvas asserts on it during the default-content import:

AssertionError: assert($entity instanceof EntityInterface)
  canvas/src/EventSubscriber/DefaultContentSubscriber.php line 204
  #1 DefaultContentSubscriber.php(187): processComponentInputOnImport()

That aborts the whole install, so the cost of a bad export is a site that cannot be built at all. A re-export is the easy way to introduce one: it can add a depends block and image references pointing at media that exist in the source site but were never exported into the recipe.

This is preventive, not a bug report. The 1.0.x branch is currently clean — all 22 CANVAS_ENTITY_REFERENCE targets in content/ resolve against the 183 uuids the recipe ships, 0 unresolved. The point is to keep it that way, because the failure mode is invisible until an install is attempted.

Steps to reproduce

There is nothing to reproduce on the branch; this is a gap in the checks, not a defect in the shipped content. The check can be demonstrated by pointing any CANVAS_ENTITY_REFERENCE in content/ at a uuid the recipe does not ship and confirming that nothing in the project currently objects until install time.

Proposed resolution

• Add a check that walks every CANVAS_ENTITY_REFERENCE target_uuid and every _meta.depends entry in content/** and resolves each one against the uuids the recipe actually ships.
• Fail with the offending file, uuid and target type named, so the message points straight at the export that broke.
• Run it in CI so a re-export cannot ship a dangling reference.

Remaining tasks

• ✅ File an issue
• ❌ Addition/Change/Update/Fix
• ❌ Testing to ensure no regression
• ❌ Automated unit/functional testing coverage
• ➖ Developer Documentation support
• ➖ User Guide Documentation support
• ➖ UX/UI designer responsibilities
• ➖ Accessibility and Readability
• ❌ Reviewed by a human
• ❌ Code review by maintainers
• ❌ Full testing and approval
• ❌ Credit contributors
• ❌ Review with the product owner
• ❌ Update Release Notes
• ❌ Release

User interface changes

• N/A

API changes

• N/A

Data model changes

• N/A

Release notes snippet

• Added a check that every entity reference in the recipe default content resolves to an entity the recipe ships, so a bad re-export cannot ship an install-breaking dangling reference.

AI-Generated: Yes