Extract CLI recipe validation helpers

[chubes4]

Summary

• Extract CLI recipe parsing, validation, workflow phase, and policy helper logic from packages/cli/src/index.ts into packages/cli/src/recipe-validation.ts.
• Keep public CLI behavior unchanged while shrinking the entrypoint and preserving existing recipe dry-run/run/validate call sites.
• Reuse the extracted site-seed selector helper from the remaining site seed runtime checks in index.ts.

Tests

• npm run build
• npm run recipe-dry-run-smoke
• npm run recipe-site-seed-smoke
• npm run recipe-staged-files-smoke
• npm run recipe-heavyweight-plugin-runtime-smoke
• node packages/cli/dist/index.js recipe validate --recipe artifacts/recipe-workflow-phases-smoke/recipe.json --json
• node packages/cli/dist/index.js recipe-run --recipe artifacts/recipe-workflow-phases-smoke/recipe.json --dry-run --json

Caveats

• npm run recipe-workflow-phases-smoke timed out after 5 minutes in the live Playground recipe-run path during local verification. The same recipe's recipe validate and recipe-run --dry-run CLI checks passed, and the other focused recipe smoke checks passed.
• npm install was needed because the isolated worktree was missing node_modules; incidental package-lock.json version churn from install was reverted before commit.

AI assistance

• AI assistance: Yes
• Tool(s): OpenCode (openai/gpt-5.5)
• Used for: Extracted the recipe validation/policy helper module, ran focused verification, and drafted the PR description. Chris remains responsible for review and merge decisions.