fix(schema): forbid extra fields on AgentDef/ParallelGroup/ForEachDef/WorkflowConfig

[jrob5756]

Closes #140

Problem

A user nesting parallel: or for_each: inside an agents: item used to have the misnested field silently dropped by Pydantic's default extra="ignore". The wrapper became a regular type: agent with no model and no prompt, fell through to the Copilot provider's hard-coded gpt-4o default, and failed at runtime with:

ProviderError: ... Model "gpt-4o" is not available.

The error pointed at the provider model — three layers downstream of the actual schema mistake.

Fix

(a) extra="forbid" on key workflow models

Add model_config = ConfigDict(extra="forbid") to:

• AgentDef (primary culprit)
• ParallelGroup
• ForEachDef
• WorkflowConfig

The misnested YAML now fails at parse time with a clear Pydantic error pointing at the offending location:

2 validation errors for WorkflowConfig
agents.0.parallel
  Extra inputs are not permitted [type=extra_forbidden, ...]
agents.0.failure_mode
  Extra inputs are not permitted

This also catches field typos (e.g. prmpt: instead of prompt:, agnts: at top level instead of agents:).

(c) Show parallel/for-each counts in conductor validate summary

Adds "Parallel Groups" and "For-each Groups" rows to the validate summary table when present. Their absence is now a visible signal that something the user thought they declared isn't being parsed as such.

Bonus: fix examples/for-each-simple.yaml

This example was itself relying on the silent-drop behavior — it had a top-level input: block (every other example correctly nests it under workflow:). With extra="forbid" this would have failed, so this PR also moves input: under workflow: where it belongs. The example was previously not actually receiving the documented items workflow input.

Skipped from issue

• (b) Validator rejecting agents with neither prompt nor model — (a) already catches the reported failure shape.
• (d) Provider hard-coded gpt-4o default — separate concern.

Risk

Adding extra="forbid" is a breaking change for any user YAML that has typos that "happen to work." In-repo examples were audited (make validate-examples) and only for-each-simple.yaml was affected (and that case was a real bug, fixed in this PR).

Tests

• New TestExtraFieldsForbidden test class with 5 regression tests covering misnested parallel:/for_each: on AgentDef, typo'd field on AgentDef, extra field on ParallelGroup, and extra top-level field on WorkflowConfig.
• Full test suite: 2376 passed, 1 unrelated integration timeout (test_copilot_large_write — real Copilot SDK session timeout).
• make lint ✓
• make validate-examples ✓

Verification

The original repro from #140:

agents:
  - name: review_group
    parallel:
      - technical_reviewer
      - readability_reviewer

Before: Validation Successful then a runtime gpt-4o model error.
After: clear schema error pointing at agents.0.parallel.