Handle validate errors cleanly

[httpdss]

Summary

• Add ValidationConfigError for expected structure validation failures.
• Catch missing files, YAML parser errors, read errors, and invalid config shapes at the validate command boundary.
• Exit with concise ❗ ... messages and status 1 instead of Python tracebacks.

Verification

• pre-commit run --all-files passed
• pytest -q passed: 192 passed
• git diff --check passed
• Ad-hoc verification script /tmp/hermes-verify-structkit-validate-clean-errors-* passed for missing file, invalid YAML, invalid config shape, and top-level non-mapping YAML; script was removed after execution.

Closes #163