feat: validate map-to-tileset references

[jasoncavinder]

Summary

• add a pure, read-only project-wide map-to-tileset reference validator
• add tilewright validate-tilesets <PATH> with deterministic human and
  versioned JSON output
• report missing catalog records as findings while preserving structural
  prerequisite failures as typed errors
• record the evidence contract and accepted ADR 0013

Stack

This PR intentionally targets codex/tileset-catalog. It contains only the
validation layer above the tileset catalog and can be retargeted to dev after
the prerequisite PR merges.

Evidence and impact

The validator matched an independent extraction across four RPG Maker MZ
1.10.0 projects, 196 map references, and 220 bounded comparisons. A
finding-free result is deliberately not a claim of general project validity,
editor acceptance, asset existence, tile behavior, or write safety.

Verification

• generated synthetic finding, structural-error, ordering, preservation,
  resource-limit, terminal-safety, and CLI tests
• independent four-project differential audit
• complete Rust workspace quality gate passed locally
• post-review targeted core and CLI gates passed
• git diff --check passed

[jasoncavinder]

Superseded by #32. The replacement branch is based on the accepted ADR 0012 tileset branch, has an identical resulting source tree, and avoids rewriting the already-published branch.