Make validation scripts offline safe by default

[Mopati123]

Summary

• Make preflight broker checks opt-in via --allow-broker-network.
• Make state clearing and logger/session creation opt-in via --allow-state-mutation.
• Make the full validation runner skip broker validation by default and write report artifacts only with --allow-report-write.
• Replace live-production approval language in validation reports with offline validation wording.
• Add rootfile tests proving default validation is offline and non-mutating.

Validation

• python -m pytest tests/rootfile/test_validation_script_safety.py -q -> 5 passed
• python -m pytest tests/rootfile -q -> 120 passed
• scoped git diff --check -> passed

Safety

• No broker execution or canary run in this pass.
• .github, .env, logs/, data/, and runtime artifacts were not included.
• kluster was attempted after edits, but review is blocked because the trial has ended.