feat(validation): generate runtime validators from types for trust boundaries (`validate<T>`)

Problem

Sound static types stop at trust boundaries: values from JSON.parse, HTTP requests, DB rows and FFI never meet a type. packages/validation holds string predicates and compiler resource limits with no connection to types, and its matchesRegex is only a glob match. The only type information that reaches the engine today is decorator metadata. (New design direction.)

Evidence (origin/main @ d4b219507)

• packages/validation/src/rules.zig:137-153

Scope

• validate<T>(x) (TS) / equivalent Home intrinsic, lowered by the checker into a generated guard for T.
• Supports objects, unions (discriminated and not), arrays, tuples, literals, optionals, nested types.
• Guards double as the verification for sound-mode type predicates and downcasts.
• Fix matchesRegex to use a real regex engine (or rename it).

Acceptance criteria

• Generated guards accept valid and reject invalid shapes for a fixture matrix of types.
• Benchmark vs. zod / typia on the same schemas.

Links

Depends on: #782, #786 Related: #784 Part of #814.