feat: add MissingToolRule semantic validation

Flags when a workflow stage's allowedTools references a tool name that
is not registered in the tool registry (config drift), surfaced as a
non-blocking WARNING.

- Add ValidationContext.availableTools (nullable; null = registry
  unavailable, skip the check)
- MissingToolRule emits one MISSING_TOOL warning per (stage, tool) pair,
  deterministically ordered
- Populate availableTools from the ToolRegistry at the orchestrator
  construction site; wire the rule into the prod SemanticValidator

core/kernel/src/main/kotlin/com/correx/core/kernel/orchestration/SessionOrchestrator.kt

@@ -304,7 +304,11 @@ abstract class SessionOrchestrator(
             is InferenceResult.Failed -> StageExecutionResult.Failure(inferenceResult.reason, retryable = true)
             is InferenceResult.Success -> {
                 if (isCancelled(sessionId)) return StageExecutionResult.Failure("CANCELLED", retryable = false)
-                val validationCtx = ValidationContext(graph = graph, sessionState = session.state)
+                val validationCtx = ValidationContext(
+                    graph = graph,
+                    sessionState = session.state,
+                    availableTools = toolRegistry?.all()?.map { it.name }?.toSet()
+                )
                 when (val outcome = mapValidationOutcome(sessionId, stageId, validationCtx)) {
                     is StageExecutionResult.Success -> {
                         emitToolArtifacts(sessionId, stageId, stageConfig)