feat: add MissingToolRule semantic validation

Flags when a workflow stage's allowedTools references a tool name that
is not registered in the tool registry (config drift), surfaced as a
non-blocking WARNING.

- Add ValidationContext.availableTools (nullable; null = registry
  unavailable, skip the check)
- MissingToolRule emits one MISSING_TOOL warning per (stage, tool) pair,
  deterministically ordered
- Populate availableTools from the ToolRegistry at the orchestrator
  construction site; wire the rule into the prod SemanticValidator

apps/server/src/main/kotlin/com/correx/apps/server/Main.kt

@@ -37,6 +37,7 @@ import com.correx.core.validation.artifact.ArtifactPayloadValidator
 import com.correx.core.validation.pipeline.ValidationPipeline
 import com.correx.core.validation.semantic.SemanticValidator
 import com.correx.core.validation.semantic.rules.CycleExitRule
+import com.correx.core.validation.semantic.rules.MissingToolRule
 import com.correx.infrastructure.InfrastructureModule
 import com.correx.infrastructure.artifactscas.DefaultMaterializingArtifactWriter
 import com.correx.infrastructure.inference.DefaultProviderRegistry
@@ -114,6 +115,7 @@ fun main() {
                 SemanticValidator(
                     rules = listOf(
                         CycleExitRule(requirePolicyForCycles = false),
+                        MissingToolRule(),
                     ),
                 ),
             ),