test: OPA RVM validation (microsoft#514)

- fixes:
  - ensure loop hoist lookups reserve query capacity and keep loop-var tables sized when compiling default rules
  - rebuild hoisting tables with the analyzer’s schedule when available so statement order matches evaluation

- OPA test
  - Also test using RVM workflow in OPA suite
  - Maintain a list of test folders that don't yet pass and skip them

Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>

Author: anakrish

src/compiler/hoist.rs

@@ -510,6 +510,7 @@ impl LoopHoister {
         query: &Query,
         parent_context: &ScopeContext,
     ) -> Result<ScopeContext> {
+        self.lookup.ensure_query_capacity(module_idx, query.qidx);
         let mut context = parent_context.clone();
         context.current_scope_bound_vars = parent_context.current_scope_bound_vars.clone();
 

src/interpreter.rs

@@ -3375,6 +3375,7 @@ impl Interpreter {
     pub fn eval_default_rule_for_compiler(&mut self, rule_path: &str) -> Result<Value> {
         self.input = Value::Undefined;
         self.data = Value::Undefined;
+        self.ensure_loop_var_values_capacity();
 
         let default_rules = self.compiled_policy.default_rules.get(rule_path).cloned();
 
@@ -4088,7 +4089,12 @@ impl Interpreter {
 
         // Populate loop hoisting lookup table
         use crate::compiler::hoist::LoopHoister;
-        let hoister = LoopHoister::new();
+        // Re-run hoisting with the analyzer's schedule so statement order is preserved.
+        let hoister = if let Some(schedule) = compiled_policy.schedule.clone() {
+            LoopHoister::new_with_schedule(schedule)
+        } else {
+            LoopHoister::new()
+        };
         let loop_lookup = hoister.populate(compiled_policy.modules.as_ref())?;
         compiled_policy.loop_hoisting_table = loop_lookup;