[fm-var] Add non-mutating validation and stable diagnostics

[DandyLyons]

Problem / outcome

Add a non-mutating RFC 001 Rev 3 validation workflow for local use, hooks, and CI, with stable diagnostic categories, structured reports, and documented exit statuses.

Epic: #111. Milestone: 4 — CLI workflows.

In scope

• Validate syntax/placement, attributes, source resolution/access, YAML query-argument projection, RFC 9535 validity/functions/resource limits, cardinality/value shape, split fallbacks, coercion, format cascade/options, security rules, and cache freshness.
• Aggregate per-element/per-file diagnostics instead of stopping at the first recoverable failure.
• Human-readable plus versioned JSON output with deterministic ordering and summaries.
• Define stale-cache policy and exit codes for clean, validation-failed/stale-policy, operational, and usage outcomes.

Relevant specification sections

• §2 element conformance.
• §3.4–3.9 resolution, query results, failure, formatting, and escaping.
• §4 querying/projection.
• §7 and §9 edge/security/resource guidance.

Dependencies and blockers

• Blocked by [fm-var] Add inspect and explain CLI workflows #122 and its semantic prerequisites.
• Stale severity and machine-readable schema version remain product decisions.

Implementation considerations

• Use fm-var diagnostic/report types with stable code, severity, source span, element ID, related source, query metadata, and safe details.
• Validation must call the same evaluator/limits as synchronization and discard edits.
• Continue after recoverable malformed files/elements; operational errors still identify the file.
• Structured output must not imply stable object-member query order where RFC 9535 does not define it.

Acceptance Criteria

• Validation covers every Rev 3 syntax/semantic rule without mutation.
• Query-argument, query syntax/validity/capability/resource, zero/null fallback/unresolved, cardinality/shape, stale, denied, and formatting outcomes are distinguishable.
• Stable codes—not message wording—form the automation contract.
• Structured reports are versioned, deterministic within RFC guarantees, source-located, bounded, and safely redacted.
• Exit-status behavior is documented/process-tested and batch validation aggregates recoverable failures.
• Validation and synchronization produce identical diagnostics/expected caches for identical snapshots/policy/limits.

Test requirements

• Full diagnostic-code matrix, projection/query/function/limit failures, split fallback cases, mixed trees, stale-policy modes, redaction, deterministic JSON decoding, and black-box exit tests.
• Assert byte-for-byte that validation never writes.

Documentation / CLI-help impact

• Command help, CI/pre-commit examples, diagnostic catalog, JSON schema/version, query-limit notes, and exit-status table.

Explicitly deferred

• Automatic fixes beyond cache synchronization, generalized lint integration, editor protocols, and unaccepted remote/query capabilities.