Add --validate-config so the image can check its own config

[ps-pufferfish]

manifest-validator is growing a check that runs an application's own image over the ConfigMap a manifest tree carries, on the grounds that the application is the only thing that can say whether its config means anything. idcat already had the deciding code — Config::load then validate, both pure and offline — with no way to reach it but starting the service.

--validate-config loads the config, validates it and exits: 0 if valid, non-zero with the reason otherwise. No socket is bound, KMS is not reached and GitHub is not contacted. The early return sits ahead of the TLS setup, so nothing is initialised either.

--disable-auth composes with it rather than being ignored under it, because a config that is only valid with auth disabled must not pass a check run without it. That is one of the four tests.

Two things worth a reviewer's eye:

• Logging is JSON now, so the flag emits a JSON line rather than a plain message. Fine for manifest-validator, which captures stdout and stderr wholesale, but awkward to read when run by hand.
• The tests do not cover the newly required permissions table on [[installation-policy]], nor [[owner-policy]]. Config::validate enforces both; these tests just don't exercise them.

cargo test --workspace (85 tests), cargo fmt --check and cargo clippy --workspace --all-targets all pass locally.