shvma - offline policy lint (#4035)

[shvma]

What do you want to work on?

I'd like to implement #4035, openshell policy lint <file>. I'll use the bounded parser and policy types in openshell-policy-schema, then run the semantic checks in openshell-policy and the existing middleware validators, as shiju-nv suggested. The command will work without a gateway and report errors in the file. I'll move any checks it needs from the gateway into shared code so both paths use the same validation

Why this change?

I keep OpenShell policies alongside my project and want to check changes in CI before they're merged. An offline lint command would catch invalid policy files without needing gateway credentials or a running gateway. I could also run the same check locally before opening a PR.

Checklist

• I wrote this request myself (not AI-generated)
• I have read CONTRIBUTING.md