feat: render plan validation results in github check

[adityachoudhari26]

Sub-issue of #1073.

Update the deployment plan target GitHub check to include validation results.

Behavior

• Render the check body from the union of deploymentPlanTargetResult (current/proposed diff — already there) and deploymentPlanTargetResultValidation (new pass/fail sections).
• Render is idempotent — runs after plan completes (validation pending) and again after each validation result lands. The GH check API replaces output.text wholesale on each PATCH, so this is safe.
• Conclusion flips to failure if any error-severity rule has passed: false. Warnings appear in the output but don't change the conclusion.
• Section format: ✅ <rule name> for passed; ❌ <rule name> [severity] followed by indented denial messages for failed.

Files

• apps/workspace-engine/svc/controllers/deploymentplanresult/github_check.go — extend the renderer to read validation rows and append sections; compute conclusion from validation + plan status.
• apps/workspace-engine/svc/controllers/planvalidation/controller.go — call the renderer (or enqueue a render item, matching whatever pattern deploymentplanresult uses) after upserting validation results.

Depends on

Schema sub-issue, validator controller sub-issue.