fix: make resource validation read-only and fail closed

[Jeremy1844]

Root cause

The resource-validation entry point did not run the selected validators. Instead it called a hard-coded date-rewrite helper, so a validation command could mutate source files while still failing to report asynchronous validation errors reliably.

Change

• remove the content-writing repair path from validation
• run each selected resource validator sequentially and await completion
• return a non-zero process status when validation fails
• add regression coverage for read-only behavior, ordering, awaiting, and error propagation

Evidence

• Base: 9d237dd4fb37dd1fb936e3f9649020cc43a374c8 (stage)
• Regression commit: 483f1cd2f63df63960173ff417ea3ed26ef9b4ac — 0/4 introduced tests passed
• Fix commit: 0afd6e427cd8111b3e4a72e8412e14c69440b635 — 4/4 introduced tests passed
• Actual CLI fixture: delayed failure exits 1 and leaves the fixture byte-for-byte unchanged
• Syntax checks passed for the validator, runner, and test
• src, assets, package.json, and yarn.lock Git objects are identical to the base

Scope and rollout

This PR changes validator code and tests only. It contains no lesson/content, asset, schema, dependency, deployment, or migration changes. A separate source-cover validation root is intentionally kept out of this PR.

Before deployment, rerun against an approved read-only corpus snapshot with the authorized immutable private dependencies. Rollback is a revert of these two commits; do not restore the content-writing path as an operational workaround.