Adding an official MCP App validator

We should provide an official validator for MCP Apps that lives in the same repo as the spec and SDK. Today there's no canonical way to check whether an app conforms - authors hit problems at runtime, and hosts end up enforcing slightly different subsets of the rules.
A first-party validator gives authors a single source of truth for conformance (manifest structure, capability negotiation, declared view mimetypes, and so on) and lets hosts rely on a shared definition of "valid" instead of each reimplementing their own checks.

refarding co-location: the validator stays in lockstep with spec changes rather than drifting in a separate repo or userland. It also doubles as executable documentation of the rules - when the spec adds or changes a constraint, the validator and its test fixtures get updated in the same PR.

Open questions:

• Scope (static/schema validation only, or runtime/behavioral checks too?)
• How it's exposed (CLI, library API, or both)
• Whether it shares types directly with the SDK
• What counts as an error vs. a warning