feat: validate Rite configuration at startup (COD-434)

[shivros]

Summary

• validate Rite configuration before constructing state or binding the listener
• warn for empty handler sets and hard-fail unknown sources, duplicate handler names, or enabled Iris with a blank base URL
• log the compact loaded-source/handler summary required by the production dogfood finding

Verification

• cargo test --all-targets
• cargo build --all-targets
• cargo clippy --all-targets -- -D warnings
• cargo fmt --all -- --check

Closes COD-434.

[shivros]

🤖 Automated Review Panel

GPT-5.6-terra (openai-codex)

The first reviewer inspected a stale main checkout rather than this branch and reported an inapplicable block. It is excluded from the decision.

Independent reviewer (gpt-5.6-terra)

APPROVE — validation is pure; zero handlers warns; enabled Iris with blank base_url, unknown handler sources, and duplicate names are errors. The CLI logs diagnostics and exits before state construction or TCP binding. Startup summary matches the ticket. Workspace build, test, clippy, and formatting passed.

[shivros]

Auto-Merge Gate — eligible

Confidence: 0.91

The PR directly implements COD-434's scoped boot-time validation: pure diagnostics are emitted before state construction or listener binding; unknown handler sources, duplicate handler names, and blank enabled Iris URLs stop startup; an empty handler set warns; and the required compact source/handler summary is logged.

Observed checks: GitHub Actions test passed. Independent local verification passed: cargo test --all-targets, cargo build --all-targets, cargo clippy --all-targets -- -D warnings, and cargo fmt --all -- --check.

Scope limits: This is boot-time validation only; configuration hot reload remains explicitly out of scope for COD-434.