feat: validate a fragment beside the published fragments it references

[ExtraToast]

Summary

publish-fragment gains a validate-with-fragments input. It lists Projects whose latest published Intent Fragments are pulled and read beside the project file when it is validated. A project file can reference what another repository publishes. The Platform document, for example, names Flagger and the Release Gate, which JorisJonkers-dev/delivery publishes, and validated alone it refuses E_UNKNOWN_MACHINERY. So the estate's Platform document needs this to publish at all (JorisJonkers-dev/estate#2).

• The pull. Each named Project is pulled as ghcr.io/<owner>/intent-<project>:latest, outside the checkout. Its directory is added to what deploy-kit validate reads; validate reads only the documents in it. A Project that is not published yet fails the run, naming the reference.
• oras setup. oras is now set up once, before its first use.
• Tests. A workflow test holds the step's guard, its location, the reference shape and the hand-off to VALIDATE_WITH.