Add fill.manifest validator + CLI for Jenkins ragValidateManifest

fill/manifest.py provides three subcommands consumed by the upcoming
ragValidateManifest.groovy:

  - `validate` — schema + consistency check of platform/docs/manifest.json
    against platform/docs/en. Catches: missing/extra entries (.md without
    manifest record, manifest record without .md), bad sourceType,
    invalid slug shape, case-insensitive stem collisions, unclassified
    leaks outside bootstrap branch. Capped reads (5 MB manifest, 1 MB
    report/acceptance) and non-regular-file refusal guard against
    miswired Jenkins paths. Returns structured ValidationResult plus
    --json mode for programmatic consumers.

  - `estimate` — rough size summary (files, total_chars, ~tokens@4chars,
    skipped count) for PR-comment generation. Dedups duplicate inputs.
    `skipped > 0 with files == []` signals a wiring bug to the caller.

  - `check-bootstrap` — verifies BOOTSTRAP_DEFAULTS_REVIEWED:<N> marker.
    Expected count is read from bootstrap-report.md (own-line anchored
    regex blocks false positives from quoted/inline prose). N=0 case is
    auto-pass once classify.py always emits the explicit `BOOTSTRAP_
    DEFAULTS_REVIEWED: 0` line — fixed in this commit. Strict contract:
    every provided source (PR description, .rag/bootstrap/acceptance.md)
    must match expected; one stale source with another fresh one is
    rejected.

Hardening from review loop:
  - JSON-bomb protection (RecursionError caught).
  - Non-regular-file refusal (devices/FIFOs can lie about stat().st_size).
  - Bounded recursive nested .md scan (100-file cap on warning).
  - All read paths return ValidationResult on UnicodeDecodeError/OSError.
  - Cross-source acceptance marker disagreement detection.
  - SourceType type check (no TypeError on `[] not in frozenset`).
  - SLUG_RE relaxed for real platform/docs slugs (=, .) — verified
    against full manifest with 345 entries.

345-entry real manifest validates ok; bootstrap acceptance check passes
against the artifacts committed in platform@8936aae7b1.

Test coverage: 27 cases across validate, estimate, check-bootstrap,
plus real-data integration smoke. Tests use pytest-style fixtures
(tmp_path); manual harness was used pre-pip in this env, full pytest
will run under Jenkins.

See RAG-PLAN.md at aggregate root for surrounding design.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Author: AlexKirkouski

fill/bootstrap/classify.py

@@ -328,6 +328,10 @@ def _write_report(
     else:
         lines.append("No files defaulted to `paradigm` — sidebars.js covers every `.md` in docs/en "
                      "with a recognized category. No acceptance marker required.")
+        lines.append("")
+        # ALWAYS emit the machine-readable marker so check-bootstrap can read expected=0
+        # without ambiguity, on its own line per fill.manifest.MARKER_RE.
+        lines.append("BOOTSTRAP_DEFAULTS_REVIEWED: 0")
     lines.append("")
 
     lines.append("## Statistics")