[Bug] Executor never calls guard.validate() — SDD compliance checking never runs on the real execution path

Summary

HallucinationGuard.validate() is the guard's integrated entry point and the
only place the sddCompliance check runs. The executor never calls it — it
only calls validateFilePath() and validateCode() individually. As a result
SDD compliance validation never executes on the real execution path.

Verification on develop:

$ git grep -n "guard\.validate(\|hallucinationGuard\.validate("
packages/hallucination-guard/src/guard.test.ts:177
packages/hallucination-guard/src/guard.test.ts:197

validate() has zero production callers; both hits are its own unit test.
Meanwhile guard.ts gates the four checks like this:

• enabledChecks.fileExistence / importValidity / syntaxValidity /
  sddCompliance — all inside validate()
• validateFilePath() and validateCode() re-implement only the first three

So an SDD config can be loaded, parsed, and handed to the guard, and still never
influence a single validation decision at runtime.

This is the residual of #386. PR #392 correctly made validateFilePath /
validateCode honour enabledChecks, but that does not reach sddCompliance,
because that check does not exist on those two paths at all.

Reproduction

1. Configure a project with a valid sdd.yaml containing a constraint that
   generated code would violate.
2. Run any create_file task through the executor.
3. Observe that no SDD compliance validation result is ever produced — the
   executor's validateBeforeExecution / validateAfterExecution only ever
   invoke validateFilePath and validateCode.
4. git grep "guard.validate(" confirms no production caller exists.

Affected Area

executor, hallucination-guard, SDD

Environment

• OS: macOS (Darwin 25.4.0)
• Node: v24.18.0
• pnpm: 9.0.0
• FrontAgent: develop @ db42301 (v2.2.0)
• Host: CLI

Logs Or Screenshots

Relevant call sites in packages/core/src/executor/executor.ts:
validateBeforeExecution → this.config.hallucinationGuard.validateFilePath(...);
validateAfterExecution → this.config.hallucinationGuard.validateCode(...).
Neither reaches validate().

Found while fixing #387/#388 in PR #402; deliberately left out of that PR to
keep the diff focused.

Start in packages/core/src/executor/executor.ts at validateBeforeExecution and validateAfterExecution, then read packages/hallucination-guard/src/guard.ts and the existing cases in packages/hallucination-guard/src/guard.test.ts. Trace how the executor should reach the integrated validation path without losing the existing file-path and code checks. Done means an execution with SDD constraints produces a compliance validation result, with tests covering the real path.