chore(selfhost): wire up or retire the unwired config-lint.ts manifest validator

[JSONbored]

Summary

src/selfhost/config-lint.ts (lintManifestText, SelfHostConfigLintResult) is a complete, well-documented, unit-tested manifest validator with zero production callers. No CLI script, API route, MCP tool, or boot-time check invokes it — a self-hoster has no way to actually validate their .gittensory.yml or private-config file against it today.

Part of #1667.

Context

Found during a 2026-07-04 self-host review-engine audit. Confirmed via grep -rn lintManifestText src (only the definition + its own doc comment) and a repo-wide search for config-lint (only the source file and test/unit/selfhost-config-lint.test.ts). The code quality and doc-comment density suggest deliberate recent authorship, not abandoned cruft — this reads like a validator that was built ahead of its call site rather than something left behind by a refactor.

This directly serves the "make repo configuration easier to manage" goal already stated in #1667's summary, and pairs naturally with #1670 (complete and minimal Gittensory config templates) and #1673 (dashboard/admin config generator).

Requirements

• Wire lintManifestText into at least one real entry point a self-hoster can actually run. Two natural candidates (pick one, or both if scope allows without ballooning the PR):
  • A CLI command (e.g. gittensory config-lint or an equivalent under the existing self-host CLI surface) that reads a local .gittensory.yml/private-config file and prints findings.
  • An API route (e.g. /v1/repos/:owner/:repo/config-lint or a dashboard-facing equivalent) that validates a repo's current manifest and surfaces warnings in the UI.
• Keep the validator itself unchanged unless wiring it up surfaces a genuine bug in its logic.
• Do not expose any private/maintainer-only manifest content through a public-facing surface — respect the existing public/private config boundary.

Deliverables

• A PR that adds the chosen entry point(s), with tests covering the new route/command (request validation, success/failure output shape, and any auth/permission boundary for a dashboard route).
• If a CLI command is added, document it in the self-host docs (README or the self-host config reference from issue 3 in this same roadmap wave).
• If neither a CLI nor route wiring is judged worth doing right now, this issue can instead be closed with a documented decision — but the module should not be left silently dead; at minimum add a doc comment on config-lint.ts stating it is intentionally staged for a future call site (with a link back to this issue) rather than looking accidentally orphaned.

Expected outcome

A self-hoster (or the maintainer, dogfooding on JSONbored/gittensory) can actually run the manifest validator against a real .gittensory.yml/private-config file and get actionable feedback, instead of the validator existing only in its own test suite.

[linear-code]

JSO-2542