[plan] Add if/then conditional validation for field requirements

[github-actions]

Objective

Implement JSON Schema if/then constraints for conditional field requirements that are currently only enforced at compile time.

Context

Several fields have requirements that depend on other fields' values (e.g., MCP containers need network configuration in strict mode), but these aren't enforced in the schema. Users discover these requirements only through compile errors.

Conditional Requirements to Implement

1. MCP containers in strict mode require network

   • If strict: true and tools.(tool).container is present
   • Then tools.(tool).network must be specified
   • Code: pkg/workflow/strict_mode_validation.go

2. Write permissions require safe-outputs in strict mode

   • If strict: true and permissions has write scopes
   • Then safe-outputs must be configured
   • Code: pkg/workflow/strict_mode_validation.go:68

3. Sandbox-runtime requires feature flag

   • If sandbox-runtime is specified
   • Then specific feature flag must be enabled
   • Code: pkg/workflow/compiler_parse.go

4. UV packages require network access

   • If runtime.uv packages are specified
   • Then network configuration must allow PyPI access
   • Code: pkg/workflow/bundler_validation.go

Approach

Use JSON Schema if/then for each conditional:

{
  "if": {
    "properties": {
      "strict": { "const": true },
      "tools": {
        "patternProperties": {
          ".*": {
            "required": ["container"]
          }
        }
      }
    }
  },
  "then": {
    "properties": {
      "tools": {
        "patternProperties": {
          ".*": {
            "required": ["network"]
          }
        }
      }
    }
  }
}

Files to Modify

• pkg/parser/schemas/frontmatter.json - Add if/then constraints
• After changes, run make build to rebuild with embedded schema

Acceptance Criteria

• Schema enforces MCP container network requirement in strict mode
• Schema enforces safe-outputs with write permissions in strict mode
• Schema enforces sandbox-runtime feature flag requirement
• Schema enforces UV package network requirements
• Error messages clearly explain conditional requirements
• Existing valid configurations still pass validation

Testing

Create test workflows violating each conditional and verify schema validation catches them.
Related to #7575

AI generated by Plan Command for discussion #7569