validateResourceContract

Whether to check, at startup, that every configured masking policy can satisfy its resource's declared type contract — failing the application context (see ADR 0005) on a policy that would emit schema-invalid output (e.g. REDACT on a non-nullable Int, HIDE on a non-nullable field). Defaults to true; set false to defer such a policy to the runtime fail-closed backstop.