Foreign-repo validation: `wvr check --module <src> --ref <r> [--path p] [--profile x] -C <dir>`

[Max-Levitskiy]

Priority: P2 · Epic: #71 · Refs: R28, R8

Why

Most repos we want to grade have not adopted Weaver. Requiring weaver.yaml and .rw/
first inverts the funnel. check must also be provably read-only (R8).

What

• When --module is given, synthesize an in-memory WeaverConfig with one module and
  one app at . (--app-path to override), profiles from --profile, inputs from
  --input k=v (repeatable) or defaults; error on missing required inputs listing them.
• No file is written under the target: no weaver.lock, no .rw/. Module and plugin
  caches live under ~/.rw as today; --offline respected.
• check (with or without --module) opens the target read-only; any write attempt
  by core is a bug caught by a test that runs against a read-only checkout.

Acceptance

• Test: run check --module <local git> -C <clean clone> against a read-only
  directory; the command exits 0/2 on rule merits and the tree is byte-identical
  afterwards.
• Test: check with --module never creates .rw/ or weaver.lock.

Depends on

#73, #75, #77.