fix: wire enforcement validators into codex-check bridge command

[htafolla]

Summary

codex-check only ran 3 quality-gate meta-checks (tests-required, docs-required, resolve-errors) and never actually analyzed code content. eval(), innerHTML, SQL injection, console.log all passed silently.

Root Cause

Two disconnected systems in StringRay:

• quality-gate.ts — what bridge.mjs actually called (3 meta-checks + 4 basic regexes)
• enforcement/validators/ — 28 real validators with security/quality analysis (never wired in)

The `RuleEnforcer.validateOperation()) path was also broken for snippets — its dependency chain cascades failures when validators lack full project context (no test files, no package.json).

Fix

1. Wired ValidatorRegistry directly into handleCodexCheck() via loadFramework()
2. Bypassed RuleExecutor — runs validators individually to avoid dependency chain cascade
3. SNIPPET_SAFE_RULES whitelist — 10 content-analysis validators that work on raw code:
   • security-by-design — eval, XSS, SQL injection, hardcoded creds
   • input-validation — unvalidated parameters
   • clean-debug-logs — TODO, FIXME patterns
   • console-log-usage — console.log detection
   • no-duplicate-code — duplicate code blocks
   • loop-safety — infinite loop detection
   • no-over-engineering — complexity checks
   • single-responsibility — SRP violations
   • error-resolution — error handling patterns
   • module-system-consistency — mixed CJS/ESM imports

Also Fixes

• Bridge positional mode for hooks command — inline JSON after command name now parsed (e.g. node bridge.mjs hooks '{"action":"install"}')
• 3 stale test failures — missing subagent_dispatches/subagent_validations/subagent_blocks keys in test fixture + version string v2.1→v2.2

Verification

Input	Before	After
eval(data)	passed: true	passed: false (XSS)
innerHTML = html	passed: true	passed: false (XSS + no input validation)
console.log(x)	passed: true	passed: false (quality gate + enforcer)
require('fs') + import	passed: true	passed: false (mixed CJS/ESM)
function add(a,b) {}	passed: true	passed: true

• 129/129 Python tests pass
• npm run build clean, 0 errors
• All 7 bridge commands functional