normalizeAndValidateOverlayMetadata

Performs the one metadata check that belongs to the mixer: an overlay directory must not escape the assembled pack root. Format declarations are deliberately left byte-for-byte alone. A pack author owns the meaning and validity of those fields, and rewriting them can silently change which clients receive an overlay. This method is retained as the publication boundary called by MixEngine; it no longer normalizes a single input pack.