feat: validate + vendor list/inspect with --json

- validate: offline hard rules (all+include, exclude-without-all, orphaned
  include entries vs pinned inventory) and lockfile/external-area divergence
- vendor list: name/url/ref/rev/mode/item counts, human + json
- vendor inspect: per-type inventory with frontmatter metadata and recorded
  warnings read from the external area, human + json
- exit code 1 on invalid state for headless drift checks

internal/cli/vendor.go

@@ -15,6 +15,8 @@ func newVendorCmd() *cobra.Command {
 		Short: "Curate external sources into this work repository",
 	}
 	cmd.AddCommand(newVendorAddCmd())
+	cmd.AddCommand(newVendorListCmd())
+	cmd.AddCommand(newVendorInspectCmd())
 	return cmd
 }