feat(guardrails): fail-loud DB mode + seed/validate helpers + exclusivity warning (closes #166)

[initializ-mk]

Summary

Closes the three quiet behaviors in BuildGuardrailChecker's DB-mode resolution ladder that made the feature unusable for production-grade guardrails deploys:

• Fail-loud knob — FORGE_GUARDRAILS_DB_REQUIRED=true makes an unreachable Mongo at startup a hard error instead of a silent downgrade. BuildGuardrailChecker now returns (GuardrailChecker, error); the runner propagates the failure as a non-zero exit.
• Seed + validate subcommands — forge guardrails seed-defaults prints DefaultStructuredGuardrails as JSON; forge guardrails validate-db inspects the agent's AgentConfig and warns when below baseline. Closes the "DB mode bypasses built-in defaults" footgun without library-side coordination.
• Exclusivity warning — one-shot startup warning when both FORGE_GUARDRAILS_DB is set AND a guardrails.json is present, pointing at the specific path being ignored.

Why

DefaultStructuredGuardrails ships 11 vendor-secret patterns, four PII categories, and three threat-detection thresholds — none of which are applied in DB mode (the operator's MongoDB AgentConfig is the ONLY source). An empty or partial seed leaves the agent strictly less protected than a clean default deploy, and the silent fall-back path masked the failure. This PR makes both surfaces actionable.

Operator-facing changes

Env vars

Var	Default	Behavior
FORGE_GUARDRAILS_DB_REQUIRED	false	New. When true and FORGE_GUARDRAILS_DB is set, unreachable DB at startup → runner returns non-nil error, agent refuses to serve.

CLI

forge guardrails seed-defaults > defaults.json
# pipe into MongoDB as the agent's AgentConfig seed

forge guardrails validate-db
# connects to FORGE_GUARDRAILS_DB, fetches the agent's AgentConfig,
# reports coverage; warns on missing PII / security / fewer than 5
# secret-pattern rules; exits non-zero on missing document.

Connect timeout

Trimmed NewDBGuardrailEngine Mongo connect timeout from 10s to 3s. Production fails fast on misconfigured URIs; tests measurably faster too.

Schema-shape compatibility

scoreAgentConfig tolerates both camelCase (the library struct tags — what production MongoDB carries) and snake_case (legacy seeds / hand-written docs from older guidance) without operator intervention. Pinned by TestScoreAgentConfig_SnakeCaseCompat.

Out of scope (deferred)

• Option A: library-side config merge — requires coordinating a stable merge-semantics contract with the guardrails library. Issue notes this; the seed-defaults subcommand is the issue's recommended "Option B" for first cut.
• Hot-reload of DB config — separate concern.
• Per-agent DB connection multiplexing — multi-agent single-Mongo deploy still holds one client per agent.

Test plan

• golangci-lint run ./forge-core/... ./forge-cli/... ./forge-plugins/... — 0 issues
• gofmt -w across all modules
• go test ./... in forge-core/ and forge-cli/ — all green
• New unit tests pin: REQUIRED-mode fail-loud, default warn-and-fallback, forgiving-parse on REQUIRED, one-shot exclusivity warning (fires once across multiple builds, doesn't fire when only one source is present, honors cfg.GuardrailsPath), seed-defaults round-trips through models.StructuredGuardrails, scoreAgentConfig flags empty docs / fewer-than-5 secret rules / snake_case compat / camelCase-default-no-warnings, extractCustomRules defensive across BSON shape edge cases.
• Manual smoke: FORGE_GUARDRAILS_DB=mongodb://127.0.0.1:1 FORGE_GUARDRAILS_DB_REQUIRED=true forge run — assert non-zero exit + Error log line referencing the env var.