fix: consolidate runtime validation helpers

[Brad-Edwards]

Summary

Consolidates runtime validation helper policy and backfills the remaining mail validation documentation plus ADR gate coverage.

Requirement UIDs

• (none — bug/refactor/maintenance run; see Traceability section below)

Related Issues

Closes #442
Closes #444

ADR Impact

• docs/decisions/adrs/adr-038-runtime-mail-service-logical-state.md
• docs/decisions/adrs/adr-041-participant-implementation-manifest-and-provenance.md

Changes

• Centralized runtime enum parsing, non-empty string validation, duplicate detection, list coercion, and absolute-path list validation in _base.py / runtime_values.py.
• Removed local runtime-family wrapper definitions and preserved family-specific duplicate error wording through shared helper parameters.
• Added invariant tests that block shared-helper redeclarations and assert base/runtime enum parsing share hyphen alias normalization.
• Documented mail runtime semantic validation and relationship mail_access validation in docs/explain/sdl/validation.md.
• Backfilled ADR-038 and ADR-041 with explicit security/validation gates, guardrails, and references.

Test Plan

• Unit tests pass (make test)
• Integration tests pass if applicable (make integration)
• make check passes (Spotless, SpotBugs, Error Prone, Checkstyle, JaCoCo)
• No coverage regression

tools/verify_all.py --requirement-uid DSL-139 passed via the repo nox verify session; requirement governance used the script's explicit Ground Control unavailable skip path because the unauthenticated local HTTP endpoint returned 401. Focused runtime invariant tests and pre-commit also passed.

Ground Control Checks

• make policy passes
• gc_evaluate_quality_gates passes or is unchanged by this repo-only change
• gc_run_sweep reviewed; findings fixed or recorded with rationale

Traceability

• IMPLEMENTS: implementations/python/packages/aces_sdl/_base.py, implementations/python/packages/aces_sdl/runtime_values.py, docs/explain/sdl/validation.md, docs/decisions/adrs/adr-038-runtime-mail-service-logical-state.md, docs/decisions/adrs/adr-041-participant-implementation-manifest-and-provenance.md
• TESTS: implementations/python/tests/test_runtime_family_invariants.py, tools/verify_all.py

Checklist

• Code follows project coding standards (docs/CODING_STANDARDS.md)
• No business logic in API layer
• Domain layer has no framework imports
• Envers @Audited on new entities if applicable
• Changelog fragment added at changelog.d/442.fixed.md
• Architectural docs updated if stack, package structure, or key behaviors changed

Documentation

Updated: see diff.