Add evicted/failed pods cleanup template and offline workflow validation

[mayankpande88]

Summary

Two related changes to the system-template catalog:

1. New template cleanup_evicted_and_failed_pods — mirrors the net-new "Clean Up Evicted and Failed Pods" template seeded by api-server migration V760, which was the only migration-seeded template missing from this repo (V708 and V712 were already covered). It lists, then on approval deletes, Evicted/Failed/Succeeded pods across a namespace and verifies the cleanup.

2. Offline workflow-semantics validation in scripts/validate.py — the schema check only validated shape. This adds the engine-level rules that runbook-server enforces in internal/model/validation.go and its task registry:

   • every task type is a real engine task type (an unknown/mistyped type is otherwise rejected at sync time as task not found)
   • depends_on resolves to an existing task; no self-dependency
   • no duplicate task ids; no dependency cycles
   • supported trigger types; version == v1; well-formed durations; task-timeout sum within the workflow timeout

   This is the offline counterpart of nbctl workflow validate used in nudgebee-infra. That check is server-side (posts to a live backend, needs a self-hosted runner plus PAT/NBCTL_CONFIG secrets), which does not fit a public repo and would not run on fork PRs. The offline version needs no backend or secrets, so it gates external contributions too, through the existing validate.yaml workflow with no new CI file.

Testing

• python3 scripts/validate.py — all 23 templates pass.
• python3 scripts/gen_manifest.py --check — manifest current.
• Negative check: a planted typo'd task type, duplicate id, and dangling depends_on are each reported and fail the run.

Note for reviewers

When the engine registers a new task type, add it to the TASK_TYPES set in scripts/validate.py (source of truth: runbook-server's task registry). This mirrors the existing controlled-vocabulary pattern already used for tags.labels in the schema.