Validate Workflow

Validate a workflow `definition` against the FULL run-start bundle, without saving it. Runs every gate a run start would apply — `validate_definition` (structural / port-contract validation) plus every `preflight_definition` gate (source/output completeness, locale routing, translator coverage) — not the narrower save-time subset `POST /workflows` and `PUT /workflows/{id}` use. A definition that saves cleanly can still fail every one of these; that gap is exactly what this endpoint exists to close before a definition is ever persisted. Always returns 200. `valid: false` with a populated `errors` list is itself a successful answer to "is this valid?" — 422 stays reserved for a malformed request body. A true entitlement refusal (a plan-gated node/provider the caller's plan cannot use, `ErrorCode.FORBIDDEN`) is reported separately in `blocked`: not fixable by editing the graph. A voice-ownership violation (unauthorized/unknown/unsupported voice reference) is `ErrorCode.VALIDATION_ERROR` instead — an LLM fixes it the same way it fixes any other rule, by picking a different voice/model — so it is folded into `errors` like every other rule violation, not `blocked`. No side effects — nothing is read from or written to the `workflows` table. Requires at least `editor` role. Scope is `workflows:write` deliberately: a caller who cannot create a workflow should not receive a validation result that exists only to gate creation.