Replace Cast validator payload with a plaintext gh-aw resource #1984

Outcome

Replace Squad's gzip+Base64 Cast validator transport with a reviewable plaintext gh-aw resources: sidecar that survives the agent sandbox boundary and executes directly from $GITHUB_WORKSPACE.

Evidence

The #1982 experiment proved that gh aw add bradygaster/squad/workflows/squad.md@dev installs top-level resources and that the pre-agent SHA-256 probe succeeds in a consumer repository. The subsequent Zava Cast run failed because the existing validator wrapper was created under $RUNNER_TEMP and was unavailable inside the agent execution boundary.

Time box

Maximum implementation effort: 1 hour. Stop at the time box and report remaining blockers rather than broadening scope or adding workarounds.

Exact scope

• Add the canonical plaintext validator as a top-level resources: asset under workflows/shared/.
• Execute that installed asset from .github/workflows/shared/ in $GITHUB_WORKSPACE.
• Retain pinned SHA-256 authentication, node --check, validator execution, exact authorization output, and existing typed Cast failure behavior.
• Remove the Base64 payload, gzip extraction, temporary validator script, experimental probe resource, and probe-only documentation/tests.
• Update focused gh-aw tests and generated lock output.
• Preserve the existing direct installation command and all Cast output semantics.

Explicit exclusions

• No changes under packages/squad-cli/ or packages/squad-sdk/.
• No CLI/SDK installation, packaging, runtime, or distribution changes.
• No unrelated worker/reviewer findings or workflow cleanup.
• No package-mode migration.

Acceptance criteria

• Validator source is plainly reviewable in consumer PRs.
• Fresh install and gh aw update include the validator resource.
• Runtime reads and executes the validator from $GITHUB_WORKSPACE, never $RUNNER_TEMP.
• Missing, unreadable, modified, syntactically invalid, or rejecting validators fail closed with the existing bounded Cast failure contract.
• Strict gh-aw compilation, focused tests, and repository build pass.
• PR targets dev, remains human-reviewed, and clearly states this is gh-aw-only work.

Delivery

One focused PR to dev. Do not merge automatically.