Separate raw and validated spec config loading

[aidankhogg]

Motivation

• Make a clear distinction between raw YAML/dict merge helpers and validated spec loading so callers can choose whether they want unvalidated composed dicts or a fully validated NetEngineSpec object.
• Centralize spec-data validation to avoid duplicated validation logic across multiple loader entry points and to make composition helpers reusable.

Description

• Added explicit raw composition APIs SpecConfig.load_raw and SpecConfig.load_environment_variants_raw and kept SpecConfig.load / SpecConfig.load_environment_variants as backwards-compatible aliases that return raw dictionaries.
• Added validated APIs SpecConfig.load_validated and SpecConfig.load_environment_variant_validated that compose raw dicts then delegate to the centralized validate_spec_data function to return a NetEngineSpec.
• Introduced validate_spec_data(data, ...) in netengine/spec/loader.py and refactored load_spec, load_spec_with_composition, and load_spec_with_environment to call it, eliminating duplicated validation code and resolving circular import issues via TYPE_CHECKING and local imports.
• Updated tests/test_config.py to assert that raw methods return dict, validated methods return NetEngineSpec, and that invalid composed specs are rejected.

Testing

• Ran pytest -q tests/test_config.py and the config tests passed (all new and existing config tests passed).
• Ran formatting and linting commands black and isort on modified files and compiled the changed modules successfully.
• Ran the full test suite pytest -q which revealed 2 unrelated integration failures (2 failed, 536 passed, 10 skipped) not introduced by this change; these are noted as unrelated to the config API refactor.
• Ran mypy which surfaced pre-existing typing issues in other modules (not introduced by this change).

---

Codex Task