Add customer-side proxy self-check

[JayChung0258]

What changed

• Added s2s-proxy validate --only proxy for customer-side proxy pods.
• Added generic checks for config structure, TLS files, ACLs, namespace mappings, callback syntax, numeric settings, config freshness, and local listeners.
• Added text and JSON output with stable exit codes.
• Added command documentation and test coverage.

Scope

This check reads the customer-provided config and local pod state. It does not contact the customer Temporal cluster, Temporal Cloud, or the Kubernetes API. A successful result means the setup is internally consistent and possible to use. It does not verify customer-specific values against a separate specification.

Testing

• make lint
• go test -race -tags test_dep -count=1 ./app ./encryption ./preflight
• make s2s-proxy
• git diff --check origin/main...HEAD