ci: make ForgeMesh validation portable and observable

[Masterleeaus]

Summary

Implements the bounded ForgeMesh portability/CI hygiene requirement from task-24/U07.

• Replace GNU-only grep -P parsing in validate.sh with Python stdlib parsing so npm run validate is reproducible from a clean checkout.
• Add a read-only validation workflow covering the root corpus and the separately versioned agents-profiles-cli dependency boundary (npm ci, typecheck, build).
• Convert the legacy archive workflow from checkout mutation/commit/push to read-only archive validation with contents: read.
• Document that the root corpus and nested CLI are intentionally separate inventories: 340 canonical profiles across 22 root categories versus the CLI's separate 144-profile catalog.

No profile corpus, native projections, CLI source, lockfiles, licenses, or attribution files were removed or changed. No API key is required by either validation lane.