hermes - 💡(How to fix) Fix time_reconciler: add deterministic proposal validator

Parent: #29631

Goal

Implement deterministic proposal validation for time_reconciler before any approval report or execution step.

Scope

Add validator logic that rejects/downgrades proposals when:

• referenced project does not exist in collected project taxonomy
• proposal source block IDs are missing
• proposed duration exceeds available source block duration
• proposed entries overlap in unsafe ways
• confidence is below configured threshold
• evidence is empty or counterevidence is ignored
• billing status is billable without explicit approval metadata
• source block was already applied in an audit/artifact manifest

Acceptance Criteria

• Unit tests cover valid proposals and each rejection reason.
• Validation output is machine-readable and human-readable.
• Validator is deterministic and does not call an LLM.
• Tests use synthetic fixtures only.