Semantic routers with a classifier can never be accepted #12

Problem

semantic.classifier requires provider_key_id (a typesafe ProviderKey). The gateway also accepts the name form semantic.classifier.provider_key (filesource/desugar.rs#L138-L151). The CRD generator strips provider_key_id at every depth (crd.go#L36) and adds nothing in its place, so the apiserver prunes every spelling of the field.

Reproduce

• CRD pruning leaves {"classifier": {"type": "jev"}, ...}.
• aisix validate rejects it: schema validation failed at `/semantic/classifier`: "provider_key_id" is a required property.
• The same Model with classifier.provider_key injected is Applied, so the CRD is the only blocker.

The provider_key_ref description ("semantic models leave it unset", crd.go#L78) is wrong for classifier routers.

Scores

Scores are out of 10. Higher is worse for likelihood and severity. Higher is better for mitigations, detectability, test coverage and cost vs benefit (10 = cheap fix, high value).

Fix

• Add provider_key_ref {name} under semantic.classifier in Shape, and resolve it in render to classifier.provider_key with the same resolver as Model can be served on another ProviderKey's credential after a rename #4.
• Fix the description and the README, then regenerate the Model CRD.

Tests to add

A schema test that the field exists, a render test that it resolves, and a real-binary test that a classifier Model is Applied.