fix(config): add config validation + deny_unknown_fields (#334 P3-core)

[ajianaz]

Summary

Resolves the P3-core items from #334. Config and profile values were accepted without semantic checks, so typos and out-of-range values propagated silently to runtime — config "appeared to work" but settings were ignored or produced wrong behavior.

Fixes

#	Issue	Fix
#94	Config values accepted without validation	Config::validate() runs at load time: temperature (0.0–2.0), max_tokens/timeout (≥1), max_tokens_param, response_format, output.format, hook.mode/on_violation/min_severity, provider.base_url scheme. Multiple errors aggregated.
#81	Profile values unvalidated	Profile::validate(): focus weight 1–10, recognized action/tone/detail_level. All built-in profiles pass.
#57	Unknown category actions silently blocking	CategoryAction enum with case-insensitive deserialization. A typo like blok now fails loudly at config load instead of silently becoming a blocking failure.
#58	Quality gate ignores enabled flag	evaluate() forces GateStatus::Pass when enabled: false. A disabled gate can never block a merge. Counts are still computed for reporting.
#80	Misspelled YAML keys silently dropped	#[serde(deny_unknown_fields)] on all config sections (CoraFile, ProviderSection, LlmSection, QualityGateConfig, …). quailty_gate / temprature now rejected at parse time.

Design notes

• docs: fix all documentation issues #57 action enum keeps the default warn and accepts block/warn/ignore case-insensitively. Custom Deserialize impl (Serialize still derives lowercase). CheckResult.action is now Option<CategoryAction>.
• docs: fix all documentation issues #58 computes counts/checks for reporting but forces PASS — preserves existing test contracts (severity_counts_correct) while fixing the bug.
• 🔧 Non-deterministic hash for scan cache #81 VALID_ACTIONS includes info (used by the built-in clean-code profile's testing focus area), discovered via validate_accepts_all_builtins test.
• 🔧 Naive .gitignore parser misses edge cases #80 intentionally NOT applied to ProfileRef/InlineProfileRef (untagged enums — deny_unknown_fields breaks variant probing).

Testing

• 24 new tests (validation acceptance/rejection, deny_unknown_fields, case-insensitive enum, disabled gate).
• All 637 tests pass (615 unit + 16 CLI + 6 config integration).
• Clippy clean, fmt clean, cargo audit clean.

Refs #334