feat: add explicit offline and online project validation

[meaningforger]

Change

Project authors can explicitly choose offline validation (the default, or --offline) or project validate --online with a deployment configuration, strict query inventory and a fresh private report path.

Online validation authorizes before configuration/source/registry reads, validates the selected candidate, prepares every query through production routing/Renderer/data-policy preflight before any database work, then checks physical columns/type families and ordinary EXPLAIN acceptance. Runner owns pools, secrets, deadlines and cleanup. Reports distinguish compile/catalog/engine evidence and omit SQL, values, endpoints and native errors.

Parameterized queries are explicitly unsupported before database access: the pinned Doris 3.0.8 rejects bound EXPLAIN and ClickHouse's positional driver expands values on the client. Metadata/planning acceptance does not certify result values or future SELECT permissions.

Synchronize RFC-0088, README, public/extension contracts, generated guidance and the executable table-to-query tutorial. Catalog capture remains catalog inspect; result assertions remain project test.

Validation

• Focused unit and race tests passed, including fail-closed authorization/preflight, no Execute fallback, redaction and lease cleanup.
• Documentation links passed (148 Markdown files).
• Full make check and E2E smoke tests passed. Standard CI passed.
• Final-commit standard CI passed all four checks.
• Final-commit native Doris and ClickHouse full suites passed, including actual CLI acceptance, deliberate model failures, unsupported parameter shapes and redacted credential failures.
• RFC-0088 is marked implemented for this scoped v1; parameterized engine validation is explicitly deferred.