feat: validate Sema version requirements

[HelgeSverre]

Summary

Adds registry-side validation for package sema_version_req metadata used by the installable policy pack and future version-gated packages.

• validate SemVer requirements on CLI uploads before database writes
• validate GitHub-linked package manifests before syncing tagged releases
• trim valid requirements and normalize blank values to absent
• reject non-string, malformed, and overlong requirements
• document how compatible clients select and reject package versions

The companion Sema client change selects the latest compatible non-yanked release and rejects incompatible explicit or locked installs before replacing package files.

Validation

• cargo fmt --all -- --check
• cargo clippy --all-targets -- -D warnings
• cargo test --lib — 17 passed
• git diff --check

Companion: sema-lisp/sema#142
Refs sema-lisp/sema#50