perf: investigate export rule evaluation performance (~100ms per rule per MVO)

[JayVDZ]

Summary

During sync, EvaluateExportRules takes ~100ms per export rule per MVO in a devcontainer environment. With 2 export rules, MVOs matching both rules take ~320ms. This is observable as [SLOW] diagnostic warnings in the worker logs.

Observed Timings (devcontainer, Scenario 8 Small)

• ~100ms: MVOs hitting 1 export rule (users)
• ~320ms: MVOs hitting 2 export rules, or groups with multi-valued member attributes
• The time is spread across multiple sub-operations (none individually exceed 100ms)

Breakdown

The per-rule cost is dominated by CreateAttributeValueChanges:

1. DynamicExpresso expression evaluation — reflection/IL compilation per expression string
2. MVO attribute dictionary building — iterating all MVO attributes to create expression context
3. No-net-change detection — comparing each mapped attribute against cached target CSO values
4. Multi-valued reference iteration — for group members, iterates each value individually

Potential Optimisations to Investigate

1. Expression compilation caching — verify expressions are cached across MVOs within a sync run (not recompiled per MVO)
2. Batch export evaluation — evaluate all MVOs against a rule in one pass rather than one MVO against all rules (may enable shared context)
3. Skip no-net-change on first sync — when no target CSO exists (provisioning), there's nothing to compare against
4. Attribute dictionary reuse — if the same MVO attributes are used across multiple export rules, the dictionary could be built once

Context

• On production hardware these are likely 20-50ms per rule — the devcontainer CPU constraint amplifies the cost
• This is not a bug — it's the inherent cost of expression-based attribute mapping with no-net-change detection
• Discovered during log review on 2026-03-17