validate local: implement the required-annotations check by parsing manifest.json

[friedrichwilken]

Missing feature

validate local is documented as checking "required annotations in manifest.json, SBOM presence and MOF classification", but the annotations check is a placeholder: checkAnnotations (internal/workflow/check.go:100-136) only verifies the directory exists and prints ✓ Required annotations check (simulated). The list of required keys is declared and discarded (_ = []string{...}), and it even uses key names that do not exist elsewhere (org.cncf.ai.artifact.runtime, org.cncf.ai.artifact.accelerator).

Proposal

• Read <model-path>/manifest.json (workflow.ReadUnifiedOCIManifest) and fail with "run model-cli package first" if absent, like harden does.
• Validate its annotations with the shared validation engine already used by validate gitops / validate admission (internal/workflow/validation.go), so local and registry checks agree - this is what the README promises ("one shared engine so passing in one place means passing everywhere").
• Report in the same text / --quiet / --json-output format as the other validate targets.
• Take the SBOM filename and MOF config from the manifest's layers instead of guessing filenames (fixes validate local never finds the SBOM written by harden (sbom.spdx-json vs sbom.spdx.json) #99 as a side effect).
• --model-path alone is sufficient; drop or alias the undocumented --artifact-path (validate local --model-path reports 'artifact path not specified' and skips the annotation check #100).

Related: #99, #100.

[lasomethingsomething]

Verified fixed: required-annotations check parses manifest.json for real; simulated label removed (87209b3).