Function semantic 

pub fn semantic(
    spec: &WorkloadSpec,
    ctx: &dyn ValidationContext,
    machine_id: &MachineId,
    batch: &[MeshIdent],
) -> Result<(), WorkloadValidationError>

Run semantic validation — requires yubaba state via ValidationContext.

Shape validation is NOT run here. Callers MUST run shape first; use all to enforce this automatically.

machine_id is the target machine for admission-control capacity checks. batch is the set of mesh idents being co-deployed (pass &[] for single-spec deployment); these count as “known” for depends_on resolution.