feat(ci): enforce Compass lifecycle ceiling in CI validation

[rhartuv]

Summary

Enforces the Compass lifecycle ceiling rule in CI: a child skill cannot have a more mature spec.lifecycle than its parent plugin (pack).

This PR adds programmatic validation and wires it into the existing Tier 2 structure checks. No new GitHub Actions workflow is introduced — the check runs automatically via make validate-structure in tier-2-check.yaml.

Background

By design, skill lifecycle maturity must not exceed the pack plugin lifecycle:

• Allowed order: development (0) < beta (1) < production (2)
• Missing lifecycles default to development
• deprecated skills and plugins are skipped

This rule was previously documented and enforced manually. Data fixes were already applied to bring manifests into compliance; this PR prevents future regressions.

Prior data fixes (compliance groundwork)

Manifest data was corrected before adding enforcement:

• GitHub: fix(compass): bump plugin lifecycle development -> beta to match chil… #155 — bumped plugin lifecycles from development → beta to match child skills (ocp-admin, rh-basic, rh-sre, rh-virt)
• GitLab: 400a64b821859924 — equivalent lifecycle ceiling data fix to align plugin/skill manifests with the rule

This PR adds the validator only; it does not change lifecycle values in manifests.

Changes

Dependency update

• Added pytest>=8.0 to the dev dependency group in pyproject.toml
• Regenerated uv.lock

Validator (scripts/validate_lifecycle_ceiling.py)

• Discovers packs from root catalog-info.yaml spec.targets (same convention as validate_compass_manifests.py)
• For each registered pack, compares every skill manifest against <pack>/<pack>-plugin.yaml
• Enforces skill_rank <= plugin_rank
• Defaults missing lifecycles to development
• Skips deprecated skills and plugins

Unit tests (scripts/test_validate_lifecycle_ceiling.py)

• Passing cases: skill equal to plugin, less mature than plugin, missing lifecycle defaults
• Fail case: skill more mature than plugin
• Deprecated skip logic: deprecated skill, deprecated plugin, mixed scenarios
• validate_all discovery and error handling

Makefile / CI integration

• Added standalone validate-lifecycle-ceiling target
• Wired validator + pytest into validate and validate-structure
• Picked up automatically by existing tier-2-check.yaml (make install && make validate-structure)

Test plan

• uv run python scripts/validate_lifecycle_ceiling.py — passes on current manifests
• uv run pytest scripts/test_validate_lifecycle_ceiling.py -v — 18 tests pass
• make validate-lifecycle-ceiling — passes
• make validate-structure — passes (CI path)
• make validate — passes
• Induced violation (temporarily downgrading a plugin lifecycle) correctly fails with clear errors