Add application validation hooks to typed config commands #470

Problem

Applications using EdgeZero's typed config validate, diff, and push commands need a way to enforce application-specific rules against both the original source and the final configuration after environment overrides.

The commands also read the source separately for shared checks and typed loading. If the file changes between reads, validation and publication can use different configurations.

This is a prerequisite for IABTechLab/trusted-server#1194.

Requested behavior

• Add optional source and command validation hooks to typed validate, diff, and push.
• Read the app-config source once and make those exact bytes available to the source hook before environment overrides and typed deserialization.
• Use the same effective configuration for existing checks, application command validation, diff, and publication.
• Give hooks the resolved command, selected targets, application environment prefix, source path, --no-env, and existing strict-validation setting.
• Stop on application validation failures before provider I/O or publication.
• Preserve existing APIs and behavior through no-op hooks. Do not change storage formats or secret-resolution behavior.

Verification

Cover source replacement after the initial read, explicit source paths, environment overrides, source rejection before overlay, and command rejection before publication.

Implementation: #466.