Add schema-backed NLBoot evidence validation

[mdheller]

Replacement non-draft PR for the completed Copilot branch from #4 / issue #3, created because the original PR remained stuck in draft/action_required and the connector ready-for-review mutation is broken.

Scope:

• add bundled NLBoot evidence schema;
• add valid/invalid evidence fixtures;
• add read-only sourceosctl nlboot evidence validate <path> command;
• add sourceosctl nlboot evidence inspect --validate <path>;
• update tests and README.

Validation evidence from Copilot branch:

• make validate passes locally, 30/30 tests.

Boundaries:

• no backend services;
• no runtime network schema fetches;
• no host mutation;
• no secrets, model weights, datasets, or training runs.

Closes #3.