Add BAST-native validator for validate_bytes (step 5)

Replace the jsonschema custom-keyword validator on the bytes path with
a recursive walker over the BAST typed tree. The materializer already
guarantees structural correctness; the validator enforces only the
value-domain constraints expressed in the BAST document.

- New `src/bast_validation.rs`: `validate_value` dispatches on
  `BastType`, resolving `$ref`s lazily via `BastDoc::resolve_typeref`.
  Constraint arms: integer ranges (Int8..Uint64), float finiteness,
  string/bytes `maxLength` (from `BastField::max_length`), RFC 3339
  timestamp shape, enum index bounds, union variant dispatch (recurses
  into the variant, recovering OQ-008 per-variant constraints), struct
  field presence, array count, record values.
- `engine::validate_bytes` now calls `bast_validation::validate_value`
  instead of `self.validator.validate`. The `validator` field is still
  built and used by `validate_json`/`is_valid_json` (step 6 reworks
  those).
- Enum index bounds check (`idx < values.len()`) fixes the v0.1.0 dead
  constraint: the built-in `enum` keyword checked string membership, but
  the materializer emits a numeric index that never matched.
- Errors constructed via `jsonschema::ValidationError::custom` so
  `AlkTypeError::Validation` keeps its payload type uniform with the
  `validate_json` path (D-BAST-009).
- `lib.rs`: add `pub mod bast_validation;` (engine-internal, not
  re-exported in the `pub use` block) and update the module doc.

Verification:
- cargo test --release: 446 pass (369 lib + 77 integration)
- cargo clippy --all-targets -- -D warnings: clean
- cargo build --target wasm32-unknown-unknown --release: clean
- cargo doc --no-deps: clean

src/lib.rs

@@ -19,11 +19,12 @@
 //!   offsets, zero-copy for fixed-size types.
 //! - **TUnion dispatch** ([`tunion`]): Byte-offset and field-name
 //!   discriminator dispatch over `BastUnion`.
-//! - **Validation** ([`validation`]): Custom keyword validators for all
-//!   19 `AlkType:*` kinds, delegated to the `jsonschema` crate. (Step 5
-//!   replaces the `validate_bytes` path with a BAST-native validator;
-//!   step 6 reworks `validate_json` to use a consumer-provided standard
-//!   JSON Schema.)
+//! - **Validation** ([`validation`], [`bast_validation`]): two
+//!   validators for two paths. `bast_validation` is the BAST-native
+//!   validator for `validate_bytes` — a recursive walker over the BAST
+//!   type tree (D-BAST-006). `validation` holds the v0.1.0 custom-keyword
+//!   validators, still used by `validate_json` until step 6 reworks it
+//!   to use a consumer-provided standard JSON Schema.
 //! - **Builder** ([`builder`]): Fluent Rust API for constructing alktype
 //!   JSON Schemas at runtime, producing `serde_json::Value` (ADR-009).
 //!   (Step 7 converts the builder to emit BAST JSON.)
@@ -37,6 +38,7 @@
 mod macros;
 pub mod bast;
 pub mod bast_meta;
+pub mod bast_validation;
 pub mod builder;
 pub mod data_access;
 pub mod engine;