Managed settings validation errors reported to stderr

When managed settings contain entries that fail schema validation, Claude now writes descriptive errors to stderr at startup:

• For invalid entries that are dropped but don't affect enforcement: "Managed settings contain invalid entries (remaining valid policies are still enforced):"
• For invalid entries that prevent a policy from being enforced at all: "Managed settings failed to load; policies from the failed source are NOT in effect:"

Specific field-level messages include things like "allowedMcpServers" was present but invalid; enforcing an empty allowlist (no MCP servers admitted) until it is fixed.