feat: add catalog overlay diagnostics

[rjckkkkk]

Summary

• add catalog.effective, catalog.diff, and catalog.validate_patch across MCP/CLI
• validate catalog patches against the current effective catalog before write/package rollout
• add deploy.run failure classification and cleanup of newly-created failed deployments
• document catalog overlay update capabilities and recommended central-layer usage

Verification

• go test ./...
• git diff --check