fix(validation): make single-app runs correct and audible

Two faults only visible by running the real command rather than the harness.

validateAppConfiguration never built the source index — that happened in
validateAllConfigurations. Called on its own the index was empty, so every tag
filled by a hook instead of a CFG key read as unbacked: `validation app matrix`
reported MATRIX_RUN_UID_TAG and MATRIX_RUN_GID_TAG as failures that
`validation all` correctly passed. A validator that contradicts itself depending
on how it is invoked is worse than one that is merely wrong.

It also printed nothing on success, so a clean single-app run looked identical to
one that never ran. It now reports either way, while the all-apps loop marks
itself so the per-app summary stays out of the bulk output.

Verified against the live install: matrix and mattermost both clean per-app, 39
apps clean under `all`, and running any subcommand mutates nothing (the
deliberately-kept AUTH_PROFILE orphans from configBackfillAllApps survive it).

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

scripts/validation/validate_config.sh

@@ -267,6 +267,7 @@ validateAllConfigurations()
 {
     _lpv_issues=0; _lpv_checked=0
     _lpvLoadSources
+    local _lpv_in_all=1
 
     isHeader "Validating application configuration"
     local d app