feat: manifest validation as a required PR check

[joshua-temple]

Problem

An invalid or malformed manifest can merge to trunk and only surface at the next orchestrate run, after it is already on trunk and blocking the pipeline. cascade should be able to gate the merge on its own configuration being valid, without the user wiring this up by hand.

Proposal

Generate an optional, lightweight PR-check workflow that runs cascade parse-config (plus schema validation) against the manifest on pull_request, surfacing parse/validation errors as a status check that can be made required so an invalid manifest cannot merge.

This is in-domain even though it fires on PRs: it validates cascade's own configuration only. It does not run the user's build/test CI. Keep it opt-in and self-contained, with contents: read and no other permissions.

This is intentionally narrower and cheaper than the PR plan-preview (tracked separately): no dry-run callbacks, no comment, just a fast validity gate. The two can coexist or be enabled independently.

Schema sketch

# manifest.yaml (top-level)
validate_check:
  enabled: true

Acceptance criteria

• cascade generate-workflow emits a manifest-validation PR-check workflow when enabled (opt-in, non-breaking when omitted).
• The check fails on an invalid/malformed manifest and passes on a valid one.
• The workflow requests only contents: read.
• e2e scenario: a PR introducing a YAML/schema error in the manifest turns the check red; a PR with a valid manifest turns it green.

Related: the PR plan-preview workflow and the merge-queue validation lane (separate issues); pairs with the schema_version / validation work.