Validate configuration on workspace publish and roll back on failure

Problem/Motivation

When a workspace is published, config changes are applied to Live through ConfigImporter, but validation was skipped via a reflection hack that pokes the importer's protected $validated and $extensionChangelist properties. Consequences:

• A change that leaves the site's config dependency graph inconsistent could be published without warning.
• Per-item import errors were collected, logged as a warning, and then committed anyway, so a partially-failed import was treated as success.
• A mid-import failure left Live partially written with no way back.

Proposed resolution

• Remove the reflection hack and run the full ConfigImporter validation on publish. The publish source is a complete copy of Live plus the workspace overlay, so dependency validation runs against the whole resulting tree. A change that would break the dependency graph is now rejected before anything is written.
• Take a config checkpoint before the import; on a thrown exception or any collected getErrors(), roll Live back to the checkpoint and stop the publish, preserving the workspace overlay so the changes can be re-published.
• Make the kernel test fixtures a complete, coherent source and test add coverage for a failed import that rolls back.