"""The `validate` domain — content, checklists and RON against their schemas.

Three validators with three shapes: `content` and `checklist` were Python and
moved; `ron` was bash wrapping a Python heredoc wrapping a Rust binary, so its
logic became Python and its binary call became a guarded exec (D-263).
"""