Add manifest boundary fixture validation

[Yehonal]

Summary

• Add a runtime-neutral manifest boundary validator in packages/core
• Add synthetic Sprint 0 fixture coverage for public/publishable boundary classes
• Fail closed on missing fixture classes or malformed negative cases
• Sanitize findings so diagnostics include boundary_class + path without echoing private values
• Wire manifest:fixtures into the root npm run verify gate

Boundary classes covered

• core-neutral
• sensitive-business-domain-boundary
• client-project-boundary
• private-assistant-boundary
• development-agent-boundary
• staff-community-boundary

Test plan

• npm run verify
• manifest fixture runner
• public-tree privacy sanity gate

Notes

This PR intentionally keeps real domain/bot/role topology out of the public repo. The private domain/role/agent manifest planning remains in the private OpenClaw/shared docs and should be handled separately after this review.

[Yehonal]

Closing intentionally after review: the manifest/boundary taxonomy is too private/domain-specific for the public agent-mesh repo. We will keep agent-mesh focused on OSS mesh protocol/transports/generic safety and move private manifest/domain/role boundary work to the private toolkit/docs.