fix(cli): use the server manifest validation in doctor

[TheNaubit]

What changes

Have facility doctor and the API use the same YAML parser and Zod schema for .facility.yml, so doctor catches manifests the server would reject.

The shared parser stays in the published CLI package. The API imports it, derives its types from it, and includes the file in Turbo's cache inputs so parser changes invalidate cached builds. The API keeps its existing error code and manifest hash behavior.

The CLI adds yaml and zod, which the API already uses and the lockfile already contains. This is a nonbreaking validation fix: invalid manifests fail earlier, with no data migration or changes to permissions or budgets.

Why

Closes #354

A successful doctor check should mean the manifest passes the server's validation. The current regular expressions let unsupported fields and malformed structures through, so users only find out later when they try to create a workspace.

Verification

I ran the checks in a local Docker Sandbox microVM, with no host directories mounted.

• All 11 CLI tests and both API manifest tests passed, including checks for generated manifests, unknown fields, duplicate keys and malformed YAML.
• I installed the packed CLI into a fresh temporary fixture, ran init, and checked it with doctor --json. It accepted the generated manifest and rejected it after I added an unknown environment field.
• API typecheck, the production build and declaration build passed. Changing the shared parser changed the API's Turbo task hash as expected.
• The production API Docker image built successfully, including the CLI entrypoint/import check. The packed CLI includes the parser.
• pnpm verify passed.

I couldn't complete the Docker workspace checks. The published runner is linux/amd64, and the local sandbox is ARM64. It exits with exec /usr/local/bin/docker-entrypoint.sh: exec format error; the test then gets HTTP 409 because the container has stopped. Trying emulation inside the sandbox didn't fix it. These checks still need to pass on a compatible runner before merge.

• pnpm verify passes locally
• Behaviour verified beyond the test suite (say how)
• Documentation updated, or no user-facing change

[adrian-lorenzo]

Thanks for fixing this.

Verified the shared validation and packaged CLI behavior; no blocking issues.