feat(ci): validate PPL lint across grammar surfaces

[Hanyu-W]

Description

Builds on #5 and implements the multi-surface compatibility CI design.

• Plans exactly three configurations: OpenSearch 2.19.6 with OSD's compiled-simplified grammar, the highest official GA release at or below the normalized PR target with its runtime bundle, and the SQL PR build with its runtime bundle.
• Replaces the fixed-version/discovery workflow with the six-job observation and fan-in shape.
• Retires only the legacy analytics-engine compatibility workflow; SQL Java CI and Security Plugin IT remain enabled.
• Emits a complete schema-v3 12 x 3 compatibility report, preserving missing legs as inconclusive columns and publishing artifacts before enforcement.
• Applies surface, version, then engine-mode exclusions before detector execution.
• Distinguishes detector regression, full engine relaxation, partial engine relaxation, and contract drift with query-level evidence and remediation.

Testing

• node --test scripts/ppl-lint/__tests__/*.test.mjs (218 passing)
• actionlint .github/workflows/ppl-lint-multiversion-validation.yml .github/workflows/ppl-lint-rule-validation.yml
• node --check scripts/ppl-lint/aggregate-compatibility.mjs
• node --check scripts/ppl-lint/plan-compatibility.mjs
• node --check scripts/ppl-lint/run-frontend-contract.mjs
• git diff --check

Check List

• New functionality includes testing.
• New functionality has been documented.
• Commits are signed per the DCO using --signoff or -s.

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

[Hanyu-W]

Superseded by #7, rebuilt from the base with a clean two-commit history. The replacement keeps SQL Java CI and Security Plugin IT unchanged and removes only the legacy Analytics Engine Compatibility workflow.