Summary

Add a pkg/recipe registry-validation guard that blocks new registry
components from landing without a healthCheck.assertFile, and enforces
the read-only assertion allowlist on registry-declared Chainsaw content.

Lands after #660 PR 3 (backfill) so all current components are covered
before the guard begins enforcing.

Scope

Required healthCheck.assertFile on new components

• Lint-level check in pkg/recipe that runs as part of the existing
  repo CI / make qualify surface (not new runtime behavior).
• Rejects any recipes/registry.yaml entry that lacks
  healthCheck.assertFile after this PR lands.
• Existing components are grandfathered only insofar as they all
  declare assertFile by the time this PR ships ([EPIC] Reuse Chainsaw health checks in aicr validate --phase deployment #660 PR 3 must land
  first).

Read-only allowlist enforcement

• Same lint-time check rejects any registry-declared Chainsaw content
  that uses an operation other than assert / error.
• Mirrors the runtime enforcement from [EPIC] Reuse Chainsaw health checks in aicr validate --phase deployment #660 PR 2 so violations are
  caught at PR time, not in CI runs that exercise the validator.

Surface decision (open)

• Lint at make qualify time (custom Go check in pkg/recipe test
  suite) vs. load-time at aicr recipe (recipe resolution rejects).
• The original [EPIC] Reuse Chainsaw health checks in aicr validate --phase deployment #660 wording leans lint-time. Confirm during
  implementation; both are valid, but pick one — not both.

Out of Scope

• Migrating any existing check or backfilling missing checks (those
  are [EPIC] Reuse Chainsaw health checks in aicr validate --phase deployment #660 PR 3 / PR 4).
• Removing expectedResources (the long-term disposition of the
  parallel reporting path is a separate decision; see [EPIC] Reuse Chainsaw health checks in aicr validate --phase deployment #660 PR 2 for
  the transition period).

Acceptance Criteria

• make qualify (or the chosen surface) fails when a new registry
  entry lacks healthCheck.assertFile.
• make qualify fails when registry-declared assert content uses an
  operation outside the assert / error allowlist.
• The check produces a structured ErrCodeInvalidRequest with the
  offending component name + operation.
• Documentation in docs/contributor/recipe.md (or equivalent)
  explains the contract for new components.

Related

• Parent epic: [EPIC] Reuse Chainsaw health checks in aicr validate --phase deployment #660
• Depends on: [EPIC] Reuse Chainsaw health checks in aicr validate --phase deployment #660 PR 3 (backfill must be complete first)