RFC 008 slice 1: walking skeleton for openenv validate

[zkwentz]

First actually runnable openenv validate for RFC 008. Stacked on #1045.

Local path is detect signature → parse openenv.yaml → static.manifest → policy → report. Exit 0 for pass/warn, 1 for fail, 2 for unrecognized or unsupported, 3 for internal errors.

That's all that runs. --level still defaults to semantic, but levels_run is just static. Harbor task.toml and PostTrain task.md exit 2 until those parsers exist. Two well-known files in one directory also exit 2.

--url is still the old FastAPI probe (JSON with passed and criteria). It never calls run_validation. --skip-build is on the CLI and does nothing.

Breaking: openenv validate some/dir no longer runs the multi-mode deployment checks.

uv run openenv validate envs/echo_env --level static --skip-build
# exit 0, Verdict: PASS

PYTHONPATH=src:envs uv run pytest tests/test_validation tests/test_cli -q
# 229 passed

Refs #778.

[cursor]

Cursor Agent can help with this pull request. Just @cursor in comments and I'll start working on changes in this branch.
_{Learn more about Cursor Agents}

[burtenshaw]

Addressed the latest review findings and stack blockers in 7ac4edaf plus the refreshed dependency/compatibility heads:

• bounded FastMCP to the compatible 3.x line after fresh resolution of 4.0.0 broke both MCP session-persistence tests on Python 3.11/3.12;
• made grader entry-point discovery work with both the selectable and legacy mapping APIs, verified on CPython 3.10.15;
• canonicalized and canonically sorted source-digest paths for cross-platform stability, with a byte-level regression;
• removed the downstream fixture version injections so RFC 008 slice 1: walking skeleton for openenv validate #1091 consumes RFC 008 slice 0a: core types, normalized manifest, and fixtures #1044’s corrected null goldens faithfully;
• mapped --output write failures to the documented internal-error exit code 3, with CLI coverage;
• made task.md signature probing tolerate invalid UTF-8 instead of escaping as an internal error;
• tracked the intentional signature-ambiguity behavior versus RFC wording on RFC: 008 Environment auto validation #778.

Focused validation on the bounded resolver: 235 passed (tests/test_validation, tests/test_cli, and both previously failing MCP session tests).

[bot-ci-comment]

The docs for this PR live here. All of your documentation changes will be reflected on that endpoint. The docs are available until 30 days after the last update.

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit c898cef. Configure here.}