feat: AffineScript port of tests/validate.test.ts (TS->AS campaign step 2)

[hyperpolymath]

Summary

Additive AffineScript port of tests/validate.test.ts to
tests/validate.test.affine, with the compiled Deno-ESM output
committed alongside it (tests/validate.test.deno.js). The original
.ts file is retained per the TAIL BATCH 1 additive-port guidance.

All 22 structural-validation tests pass:

$ deno run --allow-read tests/validate.test.deno.js
  ok unit: README.adoc exists
  ok unit: LICENSE exists
  ok unit: Containerfile exists
  ok unit: config/session-sentinel.toml exists
  ok unit: container/manifest.toml exists
  ok unit: .well-known/security.txt exists
  ok unit: config/ directory exists
  ok unit: container/ directory exists
  ok unit: docs/ directory exists
  ok smoke: README.adoc is non-empty
  ok smoke: LICENSE is non-empty
  ok smoke: config/session-sentinel.toml is non-empty
  ok p2p: all TOML files are well-shaped
  ok e2e: session-sentinel.toml chain
  ok e2e: container manifest chain
  ok contract: sentinel required fields
  ok contract: security.txt RFC 9116 fields
  ok contract: manifest security section
  ok aspect: no secrets in sentinel toml
  ok aspect: no secrets in container tomls
  ok aspect: critical fields not placeholders
  ok benchmark: full repo TOML scan < 2s
OK: all tests passed

Coverage parity vs the TypeScript source:

• UNIT (9), SMOKE (3), P2P (1), E2E (2), CONTRACT (3), ASPECT (3),
  BENCHMARK (1) -- all 22 cases ported one-for-one.
• Each TypeScript test maps to a pub fn test_*() -> Bool plus an
  entry in the main() driver (matches the existing
  affinescript-deno-test pub fn test_* convention so a future
  Deno.test-wrapping harness can register them without a re-port).

Stdlib gaps surfaced (not blocking this PR)

1. No TOML parser binding in AffineScript today. The TypeScript
   uses jsr:@std/toml@1's parseTOML. Worked around by regex
   matches against the raw file text -- functionally equivalent for
   the field-presence + license-string + secret-pattern invariants
   this suite protects, but a real stdlib/Toml.affine binding would
   tighten the P2P assertion ("parses without error") which is
   currently a structural-shape check.
2. string::ends_with is not pub in stdlib/string.affine,
   so the port inlines the string_sub-backed equivalent (mirrors
   the merged standards/scripts/check-ts-allowlist.affine seed --
   the same pattern was restored there for the same reason).
3. Deno.statSync exposed only as statSize in
   stdlib/Deno.affine. The port uses the statSize-or-throw
   signal as the file-exists check; a statIsFile / statIsDirectory
   extern would let us distinguish the file/dir cases the TypeScript
   source asserts via stat.isFile / stat.isDirectory.
4. No Deno.test binding -- the AffineScript Deno-ESM backend
   has no direct Deno.test(name, fn) lowering. The
   affinescript-deno-test runner is the documented path; this PR
   adopts the pub fn test_* convention so that runner can pick it
   up unchanged in a follow-up.

Compile

AFFINESCRIPT_STDLIB=<affinescript-repo>/stdlib \
  affinescript compile --deno-esm \
  -o tests/validate.test.deno.js tests/validate.test.affine

Requires affinescript >= the 2026-05-29 build that ships the
__as_walkRecursive / __as_regexMatch Deno-ESM lowerings
(commit e4f8fbf, feat(stdlib): Deno scripting surface).

Part of hyperpolymath/standards#239 / standards#241.

Test plan

• affinescript compile --deno-esm produces a clean .deno.js
• deno run --allow-read tests/validate.test.deno.js -- all 22 tests pass
• Original .ts test file retained (additive port)
• GPG-signed commit