xtask: Rust JSON Schema validator (cross-check with AJV, then migrate)

[flyingrobots]

Summary
Adopt a Rust-native JSON Schema validation path for xtask schemas using the jsonschema crate, run in parallel with the current AJV (Dockerized) implementation, and migrate once parity is demonstrated.

Motivation

• Remove remaining Node dependency from schema validation.
• Speed and portability benefits from a Rust-only toolchain.

Scope / Plan

1. Add cargo run -p xtask -- schemas --engine rust:
   • Use jsonschema crate
   • Draft: start with Draft 7 (crate default), evaluate Draft 2020-12 coverage
   • Implement a resolver that loads $ref files from the repo (no network)
2. Cross-check in CI:
   • Run both AJV (Docker) and Rust engines on the same corpus
   • Compare pass/fail sets; report diffs
3. Close gaps:
   • Formats: base64url, ISO-8601 durations, etc. (custom format handlers)
   • Multi-file $ref resolution and $id handling
4. Migrate:
   • Flip CI to Rust engine as primary; keep AJV as optional fallback for a cycle

Acceptance

• CI job shows Rust validator matches AJV results on all compiled schemas and example documents.
• No network I/O during validation; $ref resolution is repo-local and deterministic.
• Clear failure messages (path to error, schema location).

Non-goals (for now)

• Rewriting schemas; only the validator path changes.
• Introducing network fetches for $ref.

Risks / Notes

• Draft 2020-12 features may need additional coverage; start with Draft 7 where stable.
• Resolver + custom formats add code; keep well-tested and isolated.

Tracking

• After the label sync workflow merges, tag with: area: schemas, type: tooling, priority: p2