Enforce bounded output repair contracts

internal/promptdef/repository_test.go

@@ -892,6 +892,38 @@ output:
   format: text
   validation_mode: none
   repair_attempts: -1
+`,
+			wantErr:        true,
+			wantDiagnostic: "repair_attempts",
+		},
+		{
+			name: "repair attempts above maximum",
+			definition: `
+id: normalization-rule
+version: "1"
+messages:
+  - role: user
+    content: test
+output:
+  format: text
+  validation_mode: basic
+  repair_attempts: 4
+`,
+			wantErr:        true,
+			wantDiagnostic: "repair_attempts",
+		},
+		{
+			name: "none validation with repair attempts",
+			definition: `
+id: normalization-rule
+version: "1"
+messages:
+  - role: user
+    content: test
+output:
+  format: text
+  validation_mode: none
+  repair_attempts: 1
 `,
 			wantErr:        true,
 			wantDiagnostic: "repair_attempts",