Allow offline validation before provider credentials are configured

Problem

agents validate performs no provider API calls, but the generated agents.yaml contains ${VAR_NAME} references that currently must resolve before validation completes. A new user therefore cannot validate the generated project until real provider credentials exist.

Desired outcome

Provide a safe validation path that checks YAML structure, references, and provider capability rules without requiring secret values or contacting a provider. Planning and applying must continue to require resolved credentials.

Acceptance criteria

• A freshly generated project can run the documented offline validation flow without real credentials.
• Missing variables are still reported clearly, but are classified separately from schema or reference errors.
• plan, apply, sessions, and deployments continue to fail before network access when required credentials are unresolved.
• CLI contract tests cover both offline validation and credential-required commands.
• English and Chinese getting-started docs describe the final behavior.

agents validate CLI フローとそのコントラクトテストから始め、続いて plan、apply、セッション、デプロイメントがネットワークアクセス前にどのように認証情報を解決するかを比較します。完了条件は、新しく生成したプロジェクトがドキュメント化されたオフライン検証に対応し、未設定の変数とスキーマエラーまたは参照エラーを区別し、他のコマンドの認証情報チェックを維持し、英語および中国語の getting-started ドキュメントを更新していることです。