Allow offline validation before provider credentials are configured

Problem

agents validate performs no provider API calls, but the generated agents.yaml contains ${VAR_NAME} references that currently must resolve before validation completes. A new user therefore cannot validate the generated project until real provider credentials exist.

Desired outcome

Provide a safe validation path that checks YAML structure, references, and provider capability rules without requiring secret values or contacting a provider. Planning and applying must continue to require resolved credentials.

Acceptance criteria

• A freshly generated project can run the documented offline validation flow without real credentials.
• Missing variables are still reported clearly, but are classified separately from schema or reference errors.
• plan, apply, sessions, and deployments continue to fail before network access when required credentials are unresolved.
• CLI contract tests cover both offline validation and credential-required commands.
• English and Chinese getting-started docs describe the final behavior.

Commencez par le flux CLI agents validate et ses tests de contrat, puis comparez la manière dont plan, apply, les sessions et les déploiements résolvent les identifiants avant l’accès au réseau. Le travail est considéré comme terminé lorsqu’un projet fraîchement généré prend en charge la validation hors ligne documentée, distingue les variables manquantes des erreurs de schéma ou de référence, conserve les vérifications des identifiants pour les autres commandes et met à jour la documentation de démarrage en anglais et en chinois.