feat(manifests): emit schema summaries as JSON

[tang-vu]

Summary

• add validate-manifest-schema.sh --json with strict mode, totals, valid count, errors, and warnings
• keep diagnostics on stderr so stdout remains one parseable JSON document
• preserve warning and strict-mode exit semantics
• retain the existing human/verbose interface as the default

Why this matters

Extension authors and release tooling run this public validator before publishing manifests. A stable receipt lets dashboards and CI aggregate validation state without scraping box-drawing output, including the distinction between accepted warnings and strict failures.

Overlap check

Searched open and closed PRs for manifest schema validator json and PRs referencing ods/scripts/validate-manifest-schema.sh. Open PR #2600 adds custom schema mirrors, #2328 changes validation performance, and #2669/#2574 harden schema paths; none adds a JSON summary contract. The schema rules are unchanged.

Test plan

• bash ods/tests/test-validate-manifest-schema.sh
• bash -n ods/scripts/validate-manifest-schema.sh
• git diff --check -- ods/scripts/validate-manifest-schema.sh ods/tests/test-validate-manifest-schema.sh

Tradeoffs and rollback

Per-manifest diagnostic text remains on stderr rather than being duplicated in the summary; counts provide the stable automation contract. The current catalog reports three accepted compose-file warnings, accurately represented without failing non-strict mode. Removing --json restores the prior surface.

Generated with Codex

Batch compatibility

• Independently mergeable; tested combined in order feat(mode): emit routing status as JSON #3657 → feat(bootstrap): list hosted verification endpoints #3666.
• Base: upstream/main@6ff9b4fc; synthetic integration head: e45e2647.
• All focused public-boundary suites, the canonical generated-config JSON scan (12 surfaces), make lint, and git diff --check upstream/main...HEAD passed.
• tests/test-installer-context-parity.sh still fails at Hermes template bounds each model turn; the identical failure was reproduced on the exact upstream base, so it is not introduced by this batch.
• No live Docker mutation, model activation, migration, hosted deployment, or hardware validation is claimed.