AD-602: Add workflow validator

[alph-cmky]

Summary

• Adds workflow safety validation with actionable error codes/messages.
• Returns schema errors before deeper safety checks.
• Detects DAG cycles.
• Validates node input/output compatibility.
• Validates referenced agents and tools through injected resolvers.
• Validates requested tool permissions do not exceed workflow permissions.
• Marks AD-602 complete in the development backlog.

Stack

• Stacked on AD-601: Define workflow DAG schema #41 (feat/ad-601-workflow-dag-schema).

Verification

• TDD red check: pnpm test packages/workflow-core/src/validator.test.ts initially failed because validator.js did not exist yet.
• pnpm test packages/workflow-core/src/validator.test.ts
• pnpm lint && pnpm format && pnpm typecheck && pnpm test && pnpm build

Closes #17