Preview validation for unresolved references and stale plans

Summary

• Implemented branch feature/octopus-import-preview-validation for OpenSpec task 3.6.
• Added OctopusImportPreviewValidator to validate unresolved required references, missing target roles, missing machine/account references, incompatible shared-resource reuse, and stale preview plans.
• Added OctopusImportValidationResultDto and preview GeneratedAt timestamp support for stale-plan checks.
• Added validation diagnostic codes for the new blocker cases.
• Added unit coverage for validation success and blocker scenarios.
• Updated local OpenSpec progress tracking to mark task 3.6 complete; openspec/ is ignored locally via .git/info/exclude.
• Scope intentionally excludes API endpoint wiring, confirmation orchestration, and 4.x/5.x resource/action mapping validation.

Test plan

• /usr/local/share/dotnet/dotnet test tests/Squid.UnitTests/Squid.UnitTests.csproj --filter "FullyQualifiedName~Services.OctopusImport" --no-restore --disable-build-servers passed: 138/138.
• /usr/local/share/dotnet/dotnet test tests/Squid.UnitTests/Squid.UnitTests.csproj --no-restore --disable-build-servers passed: 6360/6360.
• git diff --check passed.