feat: add comprehensive ROS local validation

[guima-why]

What changed

• add local semantic validation for all 43 supported ROS functions
• infer and validate Ref, Fn::GetAtt, Resource, DataSource, extension resources, and Count behavior
• report all independent diagnostics with line, column, path, summary, and poisoned-cascade suppression
• run validation before ROS API requests, blocking on errors and attaching warnings to ToolResult
• preserve public invocation binding, one-shot authorization snapshots, and authorized TemplateBody materialization
• add complete ROS validation translations for zh, es, fr, de, ja, and pt
• add curated ROS validation catalogs, official-evidence refresh tooling, and focused validator, hook, adapter, permission, and i18n regression tests

Why

ROS templates could previously pass local generation even when intrinsic-function argument types or substitution semantics were invalid. Some failures surfaced only during PreviewStack, while others were not exposed consistently. This adds stronger local feedback without replacing ValidateTemplate.

User impact

Invalid templates fail earlier with actionable diagnostics. Warnings remain attached to the normal tool result, and valid requests continue through the existing permissions, credentials, endpoint, and ROS API flow.

Validation

• make translate
• make lint
• targeted ROS validator, hook, API adapter, permission, ToolExecutor, and i18n tests
• make test: 11358 passed, 2 skipped
• git diff --check