atelet: introduce declarative validation for the AteomSupport RPCs - #1903

  MintActorCertificate forwarded requests unvalidated and relied on the
  control plane to reject malformed ones after a round trip; now they
  fail at the node, after the certificate check so an unauthenticated
  caller still learns nothing but Unauthenticated. The CSR takes the
  same 16KiB maxBytes bound as the control-plane request it is
  forwarded into.

  docs/api-validation.md unions are flat optional fields tagged
  unionMember rather than proto oneofs, which declarative validation
  cannot see. The conversion is wire-compatible; only the Go wrapper
  types disappear. The unionMember tags land with the WorkloadSpec
  validation tags.

  Tag the flattened union members with unionMember, so a volume with no
  source or several sources is now rejected rather than silently
  tolerated, and bound SystemInfoVolume's data sources with the same
  paths-unique rule the control plane enforces. Deeper source messages
  stay opaque for follow-ups; Volume carries a per-type opt-in because
  no request descends into the WorkloadSpec tree yet.

  Bound ExternalVolumeSource and ImageVolumeSource with the same rules
  the control plane enforces on their template counterparts, and stop
  marking them opaque under Volume. storage_volume_id is required here,
  unlike the actor-status field it mirrors: the control plane only sends
  volumes that finished provisioning.

  Bound Capabilities with the control plane's grammar (uppercase, no
  CAP_ prefix, ALL only in drop, unique within each set) and floor the
  cgroup limits at zero. Container.name and the containers list are
  tagged ahead of the rest of Container: the list is keyed by name, and
  the generator requires presence tags on fields whose types now carry
  validations.

  Mirror the control plane's rules: env names are printable ASCII
  without '=', set at most once; mount paths are clean absolute Unix
  paths, unique per container, and must not nest, while a volume may be
  mounted at multiple paths. The env and volume_mounts lists on
  Container take their keys and bounds from the template counterparts.

  Mirror the template probe's rules: an RFC 3986 path capped at 1024
  characters, a port in 1..65535, and a polling timeout of at most an
  hour. The control plane always sends concrete values, so requiring
  them here is parity, not a tightening.

  The image must be a well-formed reference pinned by digest, matching
  the template rule it mirrors, and argv strings take the template's
  guardrail bounds. The container name hook rejects the reserved
  "pause", the last ValidateContainerNames rule without a declarative
  equivalent, so the herder handlers can drop that check as they wire up.

  ActorMetadataItem and TrustBundleDataSource take the control plane's
  rules: enum-bounded fields, each identity field projected at most
  once, and projected paths checked against the shared
  internal/volumepath rule that atelet also re-applies at host-write
  time. This removes the last opaque markers inside the WorkloadSpec
  tree.

  Give the request header its formats, open spec so the whole validated
  WorkloadSpec tree runs on a live RPC, and delete the hand-written
  validator: every check it made now has a declarative equivalent,
  including the reserved pause container name. actor_uid tightens from
  DNS label to UUID, matching the values the control plane mints. The
  lifecycle test fixture switches to a digest-pinned image, which is
  what validated specs actually carry.

atelet checked only that a capacity report was present. It now applies
the rules ateapi declares on WorkerResources, so bad reports are
rejected at atelet's edge instead of being forwarded.

validation-gen cannot follow ateapipb types into atelet, so the field
stays opaque and a custom hook calls resources.ValidateWorkerResources,
a hand-written copy of those rules. The Resources.limits rule moves to
resources.ValidateLimits so both packages share it, and a parity test
keeps the copy matching the generated validator. ateapi behavior is
unchanged.

Test each nested message through the message that owns it (Volume,
Container, WorkloadSpec) so errors are asserted at their real paths and
each shared type is covered once. Request tables also check the
handler-facing wrapper instead of separate edge tests.

Keep this change to the AteomSupport RPCs: MintActorCertificate,
SetWorkerCapacity, and RequestActorSuspend. AteomHerder validation, moves to a folloup.