Story 9.2 — Validate declared infrastructure versions against the built-in catalog

**Epic:** #506 — Infrastructure Version Management

Reject any deployment package whose `infrastructure-versions.yaml` declares versions outside the supported combination for the current `provisioner.cli.version`.

**Acceptance criteria:**
- Validation runs on package processing, before any upgrade step executes
- If any declared version is outside the catalog entry, reject with a clear error message naming the offending version
- Emit a K8s warning event on rejection