feat(catalog): admit the per-kind entries/<kind>/<slug>/ shelf layout

[genwave-radio]

🎯 What

Prereq for GenWave-Org/genwave-catalog#33 (split entries/ into per-kind subfolders). CatalogIndexValidator now admits both shelf layouts:

• 📁 entries/<slug>/… — what the live origin serves today
• 📂 entries/<kind-plural>/<slug>/… — what it serves after the move (personas/, themes/, fonts/, shows/)

🔒 How it stays strict

• The kind folder, when present, must name the entry's own kind — a persona manifest under entries/shows/ fails its pattern outright.
• Slug ownership now reads the second-to-last path segment (the slug in both layouts) instead of Split('/')[1].
• New one-directory invariant: an entry's manifest, meta, and assets all sit in one directory. Without it the widened patterns would let entries/fonts/x/OFL.txt and entries/x/OFL.txt coexist in one entry — distinct paths, same bare filename, and the asset route looks files up by bare filename.

🧪 Tests

• Story269: nested happy path (both layouts coexisting mid-migration), wrong-kind-folder reject, nested slug-squat reject, meta-strays-from-manifest reject
• Story279: fully nested font pack admitted; cross-layout straying asset ⇒ entry skip (index survives)
• Full Host suite 1661 ✅ · architecture laws 95 ✅ · solution builds clean

🚦 Sequencing

This must be released and deployed before the catalog-side migration PR merges — an old station fetching a migrated index rejects the whole index (fail-closed), so the shelf would go empty until upgraded. Broadcast is unaffected either way.