Restore required trusted validation lane

[Brandon Miller (brandom-msft)]

Context

Force-full sync commit 1a7f828fd60e6b0f14549612cf25e7bf2c906931 replaced the public tree with the private export and unintentionally removed the public-only workflow that emits the ruleset-required trusted status. With the ruleset unchanged, pull requests cannot satisfy the required check.

What changed

• Restore .github/workflows/validate.yml from rollback point 328833f9d39e8e0a80975950cc98dc00d9c63aff.
• Restore its runtime dependencies: detect-changed-samples.sh and validate-sample.sh.
• Restore the corresponding behavior documentation, focused regression runners, and their fixtures.
• Preserve every sample and other change delivered by the force-full sync.
• Leave the unrelated validation pilot/report workflows and assets deleted.

All 41 restored files byte-match the rollback point.

Validation

• run-detect-tests.sh: 23 passed, 0 failed.
• run-workflow-structure-tests.sh: 39 passed, 0 failed.
• Shell syntax checks passed for both runtime scripts and all three test runners.
• validate.yml parses successfully as YAML.
• git diff --cached --check passed before commit.
• Full classifier harness exercised 39 passing cases; its remaining local run was environment-limited by unavailable NuGet network access and absent Python/Node/Java/Go toolchains. The restored GitHub runner workflow provisions those toolchains.

Scope note

The force-full commit also removed Foundry Local sample content and the separate validation pilot/report stack. This PR intentionally does not restore those unrelated paths; it is limited to making the existing required trusted lane operational again.