fix(validate): align with Composer's ValidateCommand pipeline

- Wire Composer::try_load_from_file so validate uses typed Config.lock
  instead of a raw JSON read for the should-check-lock decision
- Surface LockFile::get_missing_requirement_info in check_lock_freshness,
  mirroring Composer's locker->getMissingRequirementInfo call
- Replace inline per-dep error/warning printing with output_result calls
  so each dependency gets the same header format as the root file
- Switch --with-dependencies to RepositoryManager + InstallationManager;
  skip metapackages; fall back to vendor walk when Composer unavailable
- Move license wrong-type from warnings to errors (divergence #10),
  matching ValidatingArrayLoader's classification

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

2 files changed, 24 insertions, 4 deletions

diff --git a/crates/mozart-core/src/composer.rs b/crates/mozart-core/src/composer.rs
index effcae4..c76f428 100644
--- a/crates/mozart-core/src/composer.rs
+++ b/crates/mozart-core/src/composer.rs
@@ -644,6 +644,18 @@ impl Composer {
         create_composer(project_dir, &composer_json).map(Some)
     }
 
+    /// Load Composer state keyed on a specific `composer.json` file, deriving
+    /// the project directory from `file.parent()`. Mirrors
+    /// `ValidateCommand::createComposerInstance($file)` — Composer keys
+    /// instances on a file rather than a directory for non-default paths.
+    pub fn try_load_from_file(file: &Path) -> anyhow::Result<Option<Self>> {
+        let project_dir = file
+            .parent()
+            .map(Path::to_path_buf)
+            .unwrap_or_else(|| PathBuf::from("."));
+        Self::try_load(project_dir)
+    }
+
     pub fn project_dir(&self) -> &Path {
         &self.project_dir
     }
diff --git a/crates/mozart-core/src/config_validator.rs b/crates/mozart-core/src/config_validator.rs
index 2907d74..dbed651 100644
--- a/crates/mozart-core/src/config_validator.rs
+++ b/crates/mozart-core/src/config_validator.rs
@@ -163,7 +163,7 @@ fn check_license(obj: &serde_json::Map<String, serde_json::Value>, result: &mut
             arr.iter().collect()
         }
         Some(other) => {
-            result.warnings.push(format!(
+            result.errors.push(format!(
                 "License must be a string or array of strings, got {}.",
                 serde_json::to_string(other).unwrap_or_default()
             ));
@@ -693,14 +693,22 @@ mod tests {
     }
 
     #[test]
-    fn test_validate_license_wrong_type_warns() {
+    fn test_validate_license_wrong_type_errors() {
         let json = r#"{"name": "vendor/pkg", "license": 42}"#;
         let result = parse_and_validate(json, &default_options());
         assert!(
-            result.warnings.iter().any(|w| w
+            result.errors.iter().any(|e| e
                 .contains("License must be a string or array of strings")
-                && w.contains("42")),
+                && e.contains("42")),
             "got: {:?}",
+            result.errors
+        );
+        assert!(
+            !result
+                .warnings
+                .iter()
+                .any(|w| w.contains("License must be")),
+            "wrong-type license must not appear as warning, got: {:?}",
             result.warnings
         );
     }