fix: append default policies + break domain↔resource compile cycle

[C-Sinclair]

Supersedes #1 by @barnabasJ. Original commits preserved; one follow-up commit on top restores pipeline entries and naming that were inadvertently dropped in the original branch.

Summary

Two independent fixes surfaced while adopting ash_grant in a real codebase (ARCC Center — Ash 3.x, ~57 resources, domain-level code_interface blocks).

1. cfce2b4 — append default policies after user-defined ones

AshGrant.Transformers.AddDefaultPolicies was prepending its generated policies. Ash bypass policies only short-circuit policies that come after them, so user-defined bypass action_type(:create) blocks (e.g. "allow public registration for nil actor") never fired — ash_grant's permission check ran first and denied.

Flip the builder call to type: :append so user-defined policies (including bypasses) are evaluated first and can properly short-circuit ash_grant's generated checks.

2. e56b814 — break domain↔resource compile cycle with domain-level code_interface

Combining AshGrant on a resource with AshGrant.Domain + a code_interface do define … end block on the domain deadlocked at compile:

• The resource's MergeDomainConfig transformer forced the domain to compile (to read domain-level ash_grant DSL).
• The domain's code_interface transformer was waiting for the resource to finish compiling.

Fix:

• Remove MergeDomainConfig transformer. Move resolver/scope merging from compile-time into runtime AshGrant.Info calls: resolver/1 falls back to the domain; scopes/1 merges resource + domain scopes with resource precedence.
• Convert compile-time validators to Spark verifiers. ValidateResolverPresent and ValidateScopes become verifiers — they run post-compile and can safely reach into the domain without creating a cycle. Spark surfaces verifier errors as compile warnings, so AshGrant.Check.resolve_permissions/3 also raises a clear ArgumentError at authorization time if no resolver is configured.
• Regression test. test/ash_grant/code_interface_cycle_test.exs pairs AshGrant on a resource with AshGrant.Domain + code_interface on the domain — this case deadlocked on the previous code.

3. f637749 — restore transformers and scope naming dropped during rebase

The previous two commits unintentionally dropped content already on main:

• AshGrant.Transformers.AddArgumentResolvers was removed from the extension's transformer list. That transformer wires up every resolve_argument declaration; without it the DSL entity exists but silently no-ops.
• AshGrant.Transformers.ValidateScopeThroughs was also removed, dropping compile-time validation for scope_through entities.
• Moduledoc examples in lib/ash_grant.ex were rewritten :always → :all, undoing the refactor: rename :all scope to :always across codebase jhlee111/ash_grant#84 rename in docs only.
• The new AshGrant.Verifiers.ValidateScopes lost the instance_key attribute check that main's equivalent transformer did, and added an unrelated "scope :all is missing" warning that collides with main's :always convention.

This commit restores the two transformers in the pipeline, reverts the moduledoc examples, ports the instance_key validation into the new verifier, and drops the stray common-scope warning. Test fixtures that used :all switch to :always.

Test plan

• mix test — 1062 tests, 1 failure, and that failure (default_field_policies_test.exs:52) reproduces on main unchanged, so it is pre-existing and unrelated.
• 52/52 tests in the code-cycle regression suite and the domain-inheritance suite pass.
• Compiles under mix compile (the expected "no resolver configured" warning on NoResolverPost is emitted by the verifier, as designed).