solmara-lab: CI never parses the checked-in relay/notary configs; add a doctor-load gate

[jeremi]

Part of the 1.0 release-readiness push (see release/READINESS.md). Repo: the standalone solmara-lab repo (replaces lab/ before 1.0; tracked here until it has a remote). Found during the 2026-07-07 YAML config audit.

Context

solmara-lab's CI (just lint / just test / just compose) validates compose syntax, metadata publishing, image-pin format, and fiction/secret patterns, but nothing ever parses ministries/*/config/*.yaml (6 relay configs) or notaries/*.yaml (4 notary configs) against the real products. The monorepo lab had the same gap (only a manual lab2-doctor-profile.sh, never wired into CI), and hand-maintained configs there accumulated defects that a load pass would have caught at commit time.

Scope

Add a CI job that runs registry-relay doctor --config ... and registry-notary doctor --config ... using the digest-pinned images from versions.env against every checked-in config. Since the products enforce deny_unknown_fields plus semantic validation, this is the strongest available check and costs only a container pull.

Acceptance

• Every checked-in relay and notary config is loaded by the real product binary on every PR.
• A deliberately typo'd key in any config fails CI.