feat(validate): add passport preflight checks for Checkpoints 1 & 2 (EXPLAINABILITY.md and DUTIES.md)

[naman-swami]

Summary

This PR introduces GitAgent Passport preflight validation (--passport / -p) to the opengap validate CLI command, enabling developers to locally verify Checkpoint 1 (Separation of Duties) and Checkpoint 2 (Explainability & Decision Transparency) compliance before submitting agents to the GitAgent Passport verification engine.

Problem

Previously, opengap validate checked agent.yaml, SOUL.md, tool contracts, skills, and --compliance, but did not validate EXPLAINABILITY.md or DUTIES.md. Developers would pass local CLI validation, but fail Checkpoint 1 or Checkpoint 2 on the passport platform due to missing required explainability sections (Decision reasoning, Data sources, Known limitations) or conflicting Maker-Checker assignments.

Solution & Changes

1. validateExplainabilityMd(dir):
   • Verifies root EXPLAINABILITY.md exists and is structured with markdown headings.
   • Validates the 3 mandatory Checkpoint 2 topic sections with substantive content (>= 2 sentences):
     • Decision / Reasoning logic (decision, reasoning, or how it decides)
     • Data sources / Inputs (data source, input, or data used)
     • Limitations / Constraints (limitation, constraint, or known issue)
2. validateDutiesMd(dir):
   • Inspects DUTIES.md and AGENTS.md for role definitions.
   • Enforces Separation of Duties (Maker and Checker cannot be combined or assigned to the same entity/role).
3. validatePassport(dir):
   • Aggregates Checkpoint 1 and Checkpoint 2 results into a unified preflight report.
4. CLI Option:
   • Added -p, --passport flag to opengap validate.
   • Displays clear Checkpoint 1 and Checkpoint 2 pass/fail statuses.
   • Emits a helpful tip when passport documentation exists in the directory.
5. Unit Test Suite:
   • Added src/commands/validate-passport.test.ts covering all positive and negative edge cases (100% pass rate).

Testing

• npm test passes all 61 tests across 14 test suites cleanly.
• Verified on local OpenGAP agent repositories with opengap validate --passport.