feat: add creed validate command

[shivros]

Summary

Adds generated creed validate across CLI, MCP, and HTTP. It reports structured validation diagnostics for manifest/source health without writing outputs.

• validates strict manifest schema, required version, known targets, source type/remote
• rejects unsafe, duplicate, missing, symlinked, non-regular, and unreadable source paths
• warns for empty sources and enabled targets without outputs
• preserves concise CLI output and non-zero exit behavior for validation errors

Review follow-up

The review panel found strict-schema validation was missing and filesystem errors leaked checkout-specific paths. Both were fixed with regression coverage before this PR was opened.

Verification

scripts/check-generated.sh
go generate ./... && git diff --exit-code
go build ./...
go test -race -count=1 ./...
go vet ./...
test -z "$(gofmt -l .)"

All passed locally.

Closes COD-386

[shivros]

🤖 Automated Review Panel

The panel reviewed the initial implementation. Both blocking findings were fixed in commit 13b8b39, then the full required verification gate passed.

GPT-5.5 (openai/gpt-5.5)

Blocking findings (addressed):

1. Manifest schema validation accepted unknown YAML fields and silently defaulted a missing version. Fixed: validation now uses strict YAML decoding (KnownFields(true)) with an explicit required version, plus regression tests for unknown fields and omitted version.
2. CLI renders concise human output rather than the full MCP/HTTP JSON result. This follows the ticket's explicit CLI requirement; MCP/HTTP return the structured ValidationResult with diagnostic paths.

Suggestions retained: future coverage could add CLI-level exit-code/path rendering checks and explicit source.path validation.

---

Gemini 3 Flash (google/gemini-3-flash-preview)

Blocking findings (addressed):

1. validate did not enforce manifest schema. Fixed: strict YAML decoding rejects unknown fields and preserves a missing version for validation to report.
2. Raw filesystem errors embedded checkout-specific absolute paths. Fixed: source diagnostics now use normalized, manifest-relative messages instead of raw OS error text.

Suggestions retained: future coverage could add HTTP/MCP envelope and CLI exit-code tests; a symlinked .creed root policy can be considered separately.

Post-fix verification

scripts/check-generated.sh
go generate ./... && git diff --exit-code
go build ./...
go test -race -count=1 ./...
go vet ./...
test -z "$(gofmt -l .)"

All passed locally.

[shivros]

Auto-Merge Gate rationale

Confidence: 0.92

The implementation directly fulfills COD-386: it exposes creed validate as a generated CLI/MCP/HTTP operation, performs strict manifest/schema and source-path validation, returns structured diagnostics, and includes regression coverage for valid, malformed, duplicate, missing, and traversal cases.

Checks observed: GitHub CI Test, Lint, and Secret Scan all succeeded. In an isolated checkout at 457a7ca1edb78e0b169bc1f186651c10bef328f2, scripts/check-generated.sh, go generate ./... && git diff --exit-code, go build ./..., go test -race -count=1 ./..., go vet ./..., gofmt -l ., and git diff --check origin/main...HEAD passed.

Scope limits: no secrets, deployment/cutover, billing, destructive behavior, or manual-review marker detected. The linked Linear ticket's acceptance criteria are code/test criteria satisfied by this PR.