add a dora-node.yml manifest and a dora validate CI gate

No source package is shared between node repositories, so the manifest and its
type URNs are the only contract a consumer has. Declaring them makes a wiring
mistake fail at validate time with the producer and consumer URNs, instead of
at runtime.

Every payload this node sends is a raw buffer whose shape and dtype live in the
metadata rather than an Arrow struct, so the URNs name the element type:
UInt8 for image_bgr, Float32 for depth, camera_info and point_cloud, String for
camera_state. tick is UInt64, matching how dora types timer inputs.

dataflow.yml now builds the node from the checkout with path: + build:. A
git:-sourced node does not pick up an adjacent manifest, so validating the
previous form checked nothing; with path: the CLI reports "injected 6 contract
type(s)" and a deliberately mismatched annotation exits non-zero under
strict_types. The README keeps the tag: form for consumers.

The workflow needs no camera and no ZED SDK, since validation never runs the
node. Also ignores the git/ and out/ working directories dora build creates,
and drops the ignore rules for the deleted test assets.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Y7g2cBJ5e3r15ZbJ9WZn8c

README.md

@@ -23,7 +23,33 @@ nodes:
       - camera_state
 ```
 
-See [`dataflow.yml`](dataflow.yml) for a complete runnable example with a camera display node.
+See [`dataflow.yml`](dataflow.yml) for a complete runnable example with a camera display
+node. That file builds the node from the checkout (`path:` + `build:`) rather than from a
+tag, which is what lets `dora validate` pick up the manifest described below.
+
+### Node manifest
+
+[`dora-node.yml`](dora-node.yml) declares the node's inputs and outputs with type URNs.
+No source package is shared between node repositories, so it is the only contract a
+consumer has, and it is what makes a wiring mistake fail at build time instead of at
+runtime:
+
+```
+$ dora validate dataflow.yml
+  node "zed-camera": injected 6 contract type(s) from .../dora-node.yml
+All type annotations OK.
+```
+
+Types are `std/core/v1/UInt8` for `image_bgr`, `std/core/v1/Float32` for `depth`,
+`camera_info` and `point_cloud`, and `std/core/v1/String` for `camera_state`; every
+payload is a raw buffer whose shape and dtype are in the metadata, so the URN names the
+element type rather than a struct. The `tick` input is `std/core/v1/UInt64`, matching how
+dora types timer inputs.
+
+`strict_types: true` in `dataflow.yml` makes a type warning a non-zero exit.
+[`.gitea/workflows/validate.yml`](.gitea/workflows/validate.yml) runs
+`dora validate dataflow.yml` on every push and pull request; it needs no camera and no
+ZED SDK, since validation never runs the node.
 
 ## Dependencies