feat(mcp): validate workspace deployment integrity

[digitalrisedorset]

Summary

Expands validate_workspace from a URL-only check into a deployment-integrity validator driven by the workspace registry.

Changes

• extract URL validation into WorkspaceUrlValidator
• add a generic workspace validation issue model
• validate that every registry entry references a real contract directory and contract file
• validate the deployed contract with the widget's authoritative WidgetConfigSchema
• validate release artifacts for each registry widget
  • PHP hosts: hashed IIFE bundle + CSS
  • JavaScript hosts: index.js + CSS
• keep release checks independent from contract validity so multiple deployment problems can be reported in one run
• propagate PHP_ENV into the MCP environment and use it to select the correct release-artifact checks
• make StoreWorkspaceValidator an orchestrator of separate validation concerns

Validation flow

workspace/<store>/registry.json
    ↓
registry entry
    ├── contracts/<widget>/<contract>.json exists
    ├── contract passes widgets/<widget>/src/ConfigSchema.ts
    └── workspace/release/source/<widget>
          ├── PHP: widget-<widget>@<hash>.iife.js
          │        + widget-<widget>.css
          └── JS:  index.js
                   + widget-<widget>.css

Notes

widget aliases in registry entries are respected, so an instance such as quote_form can validate against the contactus widget contract and release artifacts.

I could not execute the repository test suite from the tool environment, so this PR is ready for local/CI review before merge.