feat: validate map-to-tileset references

[jasoncavinder]

Summary

• add a pure, read-only project-wide map-to-tileset reference validator
• add tilewright validate-tilesets <PATH> with deterministic human and
  versioned JSON output
• report missing catalog records as findings while preserving structural
  prerequisite failures as typed errors
• record the evidence contract and accepted ADR 0013

Stack

This PR intentionally targets codex/tileset-catalog. It contains only the
validation layer above the tileset catalog and can be retargeted to dev after
the prerequisite PR merges.

Evidence and impact

The validator matched an independent extraction across four RPG Maker MZ
1.10.0 projects, 196 map references, and 220 bounded comparisons. A
finding-free result is deliberately not a claim of general project validity,
editor acceptance, asset existence, tile behavior, or write safety.

Verification

• generated synthetic finding, structural-error, ordering, preservation,
  resource-limit, terminal-safety, and CLI tests
• independent four-project differential audit
• complete Rust workspace quality gate passed locally
• post-review targeted core and CLI gates passed
• git diff --check passed

[jasoncavinder]

Resolved the stacked-branch conflicts with current dev in merge commit f33822e.

Resolution details:

• Kept current dev authoritative for the portable Windows tileset path test, selected-map event capability and ADR 0011, and player-start differential evidence.
• Preserved PR feat: validate map-to-tileset references #32 map-to-tileset validator API, validate-tilesets CLI command, tests, ADR 0013, compatibility claims, and differential evidence.
• Confirmed the resulting PR delta against dev is validation-only; the already-merged tileset and event capabilities are not duplicated.

Verification:

• Full workspace Rust gate passed locally: formatting, check, all tests, clippy with warnings denied, and rustdoc with warnings denied.
• 110 core tests and 77 CLI integration tests passed.
• Replacement GitHub checks passed on Ubuntu, macOS, and Windows, along with PR policy, dependency review, aggregate Rust quality, and CodeQL.