validatord: /v1/validate + /v1/iterate HTTP surface (port 3221)

Closes the last "Go primary" backlog item in
docs/ARCHITECTURE_COMPARISON.md. Go now owns the entire validator
path end-to-end — no Rust dep for staffing safety net.

Architecture: cmd/validatord on :3221 hosts both endpoints. Calls
chatd directly for the iterate loop's LLM hop (no gateway
self-loopback like the Rust shape). Gateway proxies /v1/validate +
/v1/iterate to validatord.

What's in:
- internal/validator/playbook.go — 3rd validator kind (PRD checks:
  fill: prefix, endorsed_names ≤ target_count×2, fingerprint required)
- internal/validator/lookup_jsonl.go — JSONL roster loader (Parquet
  deferred; producer one-liner documented in package comment)
- internal/validator/iterate.go — ExtractJSON helper + Iterate
  orchestrator with ChatCaller seam for unit tests
- cmd/validatord/main.go — HTTP routes, roster load, chat client
- internal/shared/config.go — ValidatordConfig + gateway URL field
- lakehouse.toml — [validatord] section
- cmd/gateway/main.go — proxy routes for /v1/validate + /v1/iterate

Smoke: 5/5 PASS through gateway :3110:
  ✓ playbook happy path
  ✓ playbook missing fingerprint → 422 schema/fingerprint
  ✓ phantom candidate W-PHANTOM → 422 consistency
  ✓ unknown kind → 400
  ✓ roster loaded with 3 records

go test ./... green across 33 packages.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

lakehouse.toml

@@ -16,6 +16,7 @@ pathwayd_url = "http://127.0.0.1:3217"
 matrixd_url  = "http://127.0.0.1:3218"
 observerd_url = "http://127.0.0.1:3219"
 chatd_url    = "http://127.0.0.1:3220"
+validatord_url = "http://127.0.0.1:3221"
 
 [storaged]
 bind = "127.0.0.1:3211"
@@ -101,6 +102,24 @@ kimi_key_file         = "/etc/lakehouse/kimi.env"
 # for long prompts, so 180 is the default.
 timeout_secs = 180
 
+[validatord]
+# Production-validator network surface (Phase 43 PRD parity).
+# Hosts /validate (FillValidator + EmailValidator + PlaybookValidator)
+# and /iterate (generate→validate→correct loop).
+bind     = "127.0.0.1:3221"
+chatd_url = "http://127.0.0.1:3220"
+# Roster of valid workers. Empty = no roster — worker-existence checks
+# all fail Consistency (correct fail-closed posture). Production points
+# at a path regenerated from workers_500k.parquet on a schedule:
+#   roster_path = "/var/lib/lakehouse/validator/roster.jsonl"
+roster_path = ""
+# Per-call cap on the iteration loop (Phase 43 default: 3).
+default_max_iterations = 3
+# Per-call cap on chat hop max_tokens.
+default_max_tokens = 4096
+# Chat hop timeout (seconds). 240s tolerates frontier reasoning models.
+chat_timeout_secs = 240
+
 [s3]
 endpoint        = "http://localhost:9000"
 region          = "us-east-1"