CLI Extensions — Stage 4: config validate command #263

Part of the EdgeZero CLI Extensions effort — stage 4 of 8.

Scope: add the config validate command — ConfigValidateArgs (manifest, app_config, strict, no_env) and run_config_validate (raw) + run_config_validate_typed<C> (typed). Validates the app-config file in its own right (TOML syntax, [config] present, deserialize into C, types, validator rules, deny_unknown_fields, #[secret] checks) plus manifest cross-checks under --strict. Three Spin-specific checks when spin is a target adapter: key-syntax (raw + typed), config/secret collision (typed-only), component discovery (raw + typed). Wire app-demo-cli config validate to the typed path.

Ship gate: app-demo-cli config validate --strict exits 0 against the example workspace; corrupted fixtures fail with the expected messages.

Design spec: §10 — Implementation plan: Stage 4.