[6.x] Reject self-referencing Content Block fields at save time

[brianjhanson]

What changed

ContentBlock::ensureNoRecursion() now iterates the nested layout's CustomField layout elements directly instead of FieldLayout::getCustomFields():

• When a nested field can't be resolved from the DB (FieldNotFoundException), the element's raw fieldUid is compared against the field's own uid, catching self-references before the field row exists.
• When it can be resolved, the original id comparison is kept (now null-guarded so two unsaved fields don't false-positive), plus a uid comparison.
• An ancestor-UID list is threaded through the recursion, so indirect cycles are caught at any depth — and validating a field that nests an already-corrupted self-referencing field terminates instead of recursing infinitely.

Why

Recursion validation had a first-save blind spot: ensureNoRecursion() relied on resolving nested fields via Fields::getFieldByUid(). On a field's first save the row doesn't exist yet, so a self-referencing fieldUid in the nested layout threw FieldNotFoundException, which was swallowed — and the self-reference passed validation. This actually happened in dev: a saved field's settings JSON contained its own UID as a nested CustomField fieldUid. Upstream Craft 5 rejects this with "Including a Content Block field recursively is not allowed."

Tests

Three new Pest feature tests in tests/Feature/Field/FieldsTest.php (written test-first; the first one reproduced the bug before the fix):

1. Saving a content block field whose nested layout references itself fails validation (first-save path, no DB row).
2. Re-saving an existing content block field with its own layout element added fails validation (DB-resolvable path).
3. Nesting a different content block field still saves (guards against over-rejection — non-cyclic nesting is legal).

Notes for reviewers

• The field-picker UI (FieldLayout::getAvailableCustomFields()) doesn't exclude the field being edited — same as upstream Craft 5, which also relies on save-time rejection. Hiding it from the picker is a possible follow-up UX improvement, tracked separately.
• Complements the in-progress construction-safety change (deferring layout creation in setFieldLayouts()), which makes loading corrupted rows safe; this PR stops the corruption from being saved in the first place. The two touch different regions of the same files and merge cleanly.

🤖 Generated with Claude Code