Deterministic reference validator

Validate the bytes you intend to publish.

This runs the same raw JSON, schema, semantic, and compatibility checks used at the Atlas ingestion boundary. It does not send your manifest into the catalog.