[kjmartens]

Freeform rebuilds the form-builder field catalog during GraphQL schema generation, slowing even {ping} and queries unrelated to Freeform. Read registered field classes and PHP attributes directly, and return cached field types before rebuilding their definitions.

The expanded GraphQL review also fixes four existing edge cases:

• Submission type scopes now use the form's actual UID, preventing per-form tokens from exposing unrelated forms' submission types.
• Form-read permissions follow the active schema instead of a process-wide cached scope.
• Cached submission types restore the correct form's mutation input fields.
• Interface resolution honors configured GraphQL type prefixes.

The export-selection unit tests use a scoped stand-in for Craft's generated CustomFieldBehavior, allowing clean dependency installs to run without bootstrapping a site. The original container is restored after each test.

Fixes #2705.

Validation:

• PHP 8.2 full PHPUnit suite: 1,648 tests, 18,855 assertions, no errors or failures; 11 skips and 16 existing PHPUnit deprecations.
• GraphQL suite against Craft 4 and Craft 5 dependencies: 16 tests and 523 assertions passed for each. Coverage includes every registered built-in field, custom/inherited attribute groups, legacy/default groups, real GraphQL execution with and without prefixes, invalid metadata, permission actions, schema switching, and cached per-form inputs.
• Full client suite: 611 tests across 93 files passed. Focused builder-state suite: 24 tests passed. Direct Vitest executables were used because installed pnpm does not meet the repository requirement.
• PHP CS Fixer, PHP compatibility checks, PHP 8.0 syntax checks, and diff whitespace checks passed.
• Local Craft 5.11.5.1: 56 original/fixed process runs across seven permission scopes, eager/lazy generation, and prefixed/unprefixed types. All 28 fixed schemas validate. Ordinary unprefixed query responses match the original. Read-only schema SDL matches byte-for-byte; mutation signatures match. Write-enabled schemas intentionally omit unrelated forms' types, and prefixed query responses now succeed instead of failing.
• Real GraphQL HTTP endpoint: 11 checks passed for restricted lists, denied reads/writes, required-field and email validation, create/save permission aliases, and successful submissions to two forms with different field handles. Stored values were verified against the correct forms. Three non-spam submissions and one intentionally spam-classified sample were created; invalid/denied requests created none.
• Browser workflow on the patched local site passed saving field/form settings including a disabled toggle, reopening through Forms without reloading, cross-form isolation, Back/Forward, unsaved tab/focus changes, Undo/Redo, and restoration verified after a reload.

QA used disposable forms without notifications. External CAPTCHA providers were disabled only on those forms; live provider verification, payments, and outbound notifications were not exercised. All QA forms, submissions, tokens, and schemas were removed afterward. The site's temporary Freeform/Calendar dependency links were restored.

Craft-core limitation: Craft 5.11.5.1 fails to load a prefixed root Query type even when all plugin GraphQL callbacks are removed. Prefix tests therefore used prefixGqlRootTypes=false; the remaining root-prefix issue is outside this plugin.