fix(sensitive_data_scanner_rules): align description with linked standard pattern on write

[michael-richey]

Problem

The destination API rejects a standard-pattern-linked sensitive data scanner rule whose attributes.description does not match the destination standard pattern's canonical description:

400 Bad Request - {"errors":[{"title":"Generic Error","detail":"description of the standard rule and the rule must match"}]}

PR #627 aligned attributes.name to the destination pattern's canonical name on create/update, but not attributes.description. The same-named standard pattern can have a different canonical description between source and destination orgs, so rules carrying the source org's description were rejected.

Fix

Extend _align_name_with_standard_pattern → _align_with_standard_pattern to also overwrite attributes.description with the destination pattern's canonical description on create/update, emitting a standard_pattern_description_rewrite metric (mirroring the existing standard_pattern_name_rewrite metric). pre_apply_hook now also populates destination_standard_pattern_description_mapping (pattern_id → canonical description).

• Applied only on create/update (not diffs/import) — source state is not mutated.
• No-op when there is no standard_pattern relationship, or when the pattern id is absent from the destination mappings.
• Name and description are aligned independently; each emits its own metric.

Testing

• 9 new unit tests in TestSensitiveDataScannerRulesCanonicalDescriptionRewrite plus 4 partial-cache regression tests in TestSensitiveDataScannerRulesPreApplyHookPartialCache.
• Full unit suite green (tox -e py39 -- tests/unit): 1481 passed, 8 skipped.
• ruff and black clean (line-length 120).

[michael-richey]

Reviewed locally. The create/update-path alignment for both name and description looks correct and the added tests are solid.

I also ran ~/.pyenv/versions/fresh-sync-cli/bin/tox -e py39 -- tests/unit/test_sensitive_data_scanner_rules.py (28 passed).

Non-blocking suggestion: in pre_apply_hook, consider guarding on both mappings (name + description) instead of only destination_standard_pattern_mapping, so a partial-cache state cannot skip description initialization in future refactors or long-lived process scenarios.

No blocking issues from my side.

[michael-richey]

Re: review suggestion (pre_apply_hook partial-cache guard)

Good suggestion — implemented in 7d88fb5. pre_apply_hook now guards on both destination_standard_pattern_mapping and destination_standard_pattern_description_mapping, repopulating when either is empty so a partial-cache state (name mapping present, description mapping empty) cannot skip description initialization in long-lived process or future refactor scenarios.

Added 4 regression tests (TestSensitiveDataScannerRulesPreApplyHookPartialCache):

• both mappings empty → repopulates both
• name-only present → repopulates (fetches description)
• description-only present → repopulates (fetches name)
• both populated → skips re-fetch

All 32 SDS tests + full unit suite (1481 passed, 8 skipped) green; ruff/black clean.