validate: manifest-driven mode to validate a whole environment

[orian]

Follow-up to #125. validate -manifest validated one node (passed via -layer/-config), using the manifest only as cross-cluster context — checking a whole environment meant a shell loop over nodes. This makes "validate the whole manifest" a first-class command.

Behavior

hclexp validate -manifest roles.hcl -env prod-us -layer-root .
# validation error: [role data] posthog.broken: view source table references "posthog.nonexistent", ...

With -manifest/-env and no -layer/-config, validate:

• loads and resolves every role's composition for -env,
• builds the cluster set from the whole manifest (member-role unions + aliases, -cluster flags last),
• runs the full validation (dependencies, MV/view sources, Distributed proxy columns) on each role against that cluster set,
• prefixes errors with the role ([role data] …) and exits non-zero if any role fails.

Mode is selected only when neither -layer nor an explicit -config is given (detected via flag.FlagSet.Visit). With -layer/-config, the existing single-node behavior (manifest as context) is unchanged — verified by regression.

Implementation

Shared helpers so both modes load role schemas once:

• loadManifestRoleSchemas — role → resolved *Schema
• clusterSetFromRoles — union member-role databases per cluster + aliases (reused by the single-node buildManifestClusters, which loads only cluster-referenced roles)
• validateManifest(...) []roleValidation — returns per-role errors, unit-tested without os.Exit
• runValidateManifest — printing + exit code; flagWasSet — explicit--config detection

Tests

• validateManifest: every role validated; a clean role passes while a role with a broken reference reports it and its cross-cluster proxy still resolves; all-clean manifest → zero errors.
• Binary end-to-end: one command flags [role data] for a broken view, then passes for the whole env once fixed.
• Single-node mode regression: validate -layer … unchanged.

Full suite green; go vet + gofmt clean. Notes in docs/plans/2026-07-08-validate-manifest-driven.md.