fix(VIOL-0066): validate-udfs surfaces agent name/filename mismatch

[Muizzkolapo]

Summary

validate-udfs loaded workflow configs through ConfigManager.load_configs() alone, skipping the agent-name identity stage the canonical loader runs immediately after it (load_configs then validate_agent_name). A workflow whose name: field did not equal its filename stem — e.g. name: real_name saved as wrong.yml — passed validate-udfs with a clean exit 0, while run and inspect rejected it. The one command whose job is to catch problems gave a false all-clear.

Fix

• ValidateUDFsCommand.validate() now calls ConfigManager.validate_agent_name() right after load_configs(), mirroring the canonical loader's stage order (fail fast on identity before UDF-reference validation).
• A mismatch is returned as a structured name_mismatch result and rendered by _handle_name_mismatch_error, consistent with the command's existing structured error types. The message names both the actual name: value and the expected filename stem, and the command exits 1.
• A ConfigurationError that is not a filename mismatch (a config with no identifiable name, whose context lacks the mismatch keys) is re-raised so it surfaces through the command's existing generic error path instead of being mislabeled as a name mismatch.

Reuses the shared check — no new YAML key, config, or dependency. run/inspect and the matched-name case are unchanged.

Verification

RED then GREEN, TDD:

• Added tests/unit/validation/test_validate_udfs_name_check.py driving the real CLI via CliRunner.
  • Mismatch test failed first because the command printed "All UDF references valid" and exited 0 (the bug), then passed after the fix (exit 1, output names both real_name and wrong).
  • Matched-name baseline exits 0 with no mismatch message (no false positive).
  • Edge test: a config with no identifiable name is not reported as a name mismatch and still fails (exit 1).
• Broader surface: tests/validation/ tests/cli/ tests/unit/validation/ tests/unit/config/ tests/unit/workflow/test_config_pipeline_stage.py — 1316 passed.
• ruff check agent_actions tests clean; ruff format --check clean.

Follow-up (not this scope)

If a future command loads a workflow YAML without going through the canonical loader, it must call validate_agent_name() too — the canonical loader is the place that guarantees it for run/inspect.