Add provider-neutral validation runner

[hudsonaikins]

Summary

• add committed argv-only validation manifests with no shell execution
• validate exact commits in detached worktrees with isolated HOME and TMPDIR
• require Entire checkpoints in the change range
• retain SHA-256 output evidence with bounded tails
• persist compare-and-swap results on refs/tabellio/validations
• consume newest exact-head validation in durable review readiness

Validation

• npm run check (52 tests)
• normal validation runner unit passes and failure/skip evidence tests
• live exact-head validation: first run recorded a legitimate nested-worktree test failure
• fixed test assumption; second live run passed in 26s
• no validation worktree residue
• Entire checkpoint 61229f2bfcff bound to code commit and validation result

Runtime boundary

Scheduler-agnostic process isolation, not a hostile-code sandbox. Untrusted changes still require disposable VM/container/sandbox capacity with network and credential policy.