feat: validate governance configuration at load time

[vitormattos]

Summary

Validate caller-owned governance configuration before repository probing or reconciliation.

The validator:

• rejects unknown keys instead of silently ignoring typos;
• validates nested rule parameters and bypass actors;
• rejects unsupported rule types;
• reports the exact JSON path that is invalid;
• runs before any GitHub API interaction.

This implements #19 without adding a runtime validation dependency.