[plan] Add oneOf constraints for mutually exclusive field pairs

[github-actions]

Objective

Add JSON Schema oneOf constraints to prevent mutually exclusive fields from being specified together.

Context

Currently, the schema allows users to specify both branches and branches-ignore, or both paths and paths-ignore, which the compiler correctly rejects. Users only discover this error at compile time instead of during editing.

Field Pairs to Constrain

1. branches vs branches-ignore (in on.push and on.pull_request)
2. paths vs paths-ignore (in on.push and on.pull_request)
3. slash_command vs label events (in on)
4. command vs label events (in on)
5. MCP command vs container (in tools.(tool))

Approach

For each pair, add a oneOf constraint that ensures only one can be present:

{
  "oneOf": [
    {
      "required": ["branches"],
      "not": { "required": ["branches-ignore"] }
    },
    {
      "required": ["branches-ignore"],
      "not": { "required": ["branches"] }
    },
    {
      "not": {
        "anyOf": [
          { "required": ["branches"] },
          { "required": ["branches-ignore"] }
        ]
      }
    }
  ]
}

Files to Modify

• pkg/parser/schemas/frontmatter.json - Main schema file
• After changes, run make build to rebuild with embedded schema

Acceptance Criteria

• Schema rejects YAML with both branches and branches-ignore
• Schema rejects YAML with both paths and paths-ignore
• Schema rejects slash_command with label events
• Schema rejects command with label events
• Schema rejects MCP configs with both command and container
• Existing valid configurations still pass validation
• Error messages clearly indicate mutual exclusivity

Testing

Create test workflows with invalid combinations and verify schema validation catches them before compile.
Related to #7575

AI generated by Plan Command for discussion #7569