test: pin validate package public API contract

[jamestexas]

Summary

The `validate/` package is mache's public API surface for AST syntax validation — external consumers (CI scripts, pre-commit hooks, x-ray-style tools) import it instead of `internal/writeback`. It had zero direct test coverage; the `find_smells --rule untested_function` scan has been flagging `Content` / `ContentErrors` / `File` / `FileErrors` / `SupportedExtension` since the package landed.

What's tested

• `Content`: valid Go → nil; invalid Go → error; unknown extension pass-through (`.xyz`) → nil
• `ContentErrors`: valid Go → empty slice; invalid Go → ≥1 entry (not asserting an exact count — tree-sitter recovery can split one logical error across multiple AST nodes)
• `File`: valid Go → nil; invalid Go → error; nonexistent path → error (the read-error contract)
• `FileErrors`: nonexistent path → nil (the diagnostic-flavor contract — read errors get swallowed because the structured-error type has no slot for them; callers that care use `File()`)
• `SupportedExtension`: parameterized table over `.go`/`.py`/`.ts`/`.tf` (`true`) and `.json`/`.md`/no-ext (`false-or-true` with `lang.Registry` as ground truth)

Test-only — no behavior change. The underlying tree-sitter parsing is exercised by `internal/writeback`'s existing suite; we don't re-test it here, just the re-export integrity.

Test plan

• `go test ./validate/ -v` — 9 tests + parameterized table all pass

[github-actions]

find_smells (advisory)

Scoped to files changed in this PR. Rules below run on the standalone (no-LLO) cross-ref tables; _ast rules (cyclomatic_complexity, long_function, long_file, magic_int_in_comparison) are not exercised here.

No structural smells in changed files. ✓

Rules: see docs/ARCHITECTURE.md for the full registry. Advisory only — these are heuristics, not gates.