Bump version to 1.0.4 and add build/AppInspect CI

[Bre77]

Intent

• Republish blocker: Splunkbase still has 1.0.3 published, so the recent @splunk react-ui 5 migration + compat work can't ship as a patch until the version moves past it.
  • Bump package.json version and src/main/resources/splunk/default/app.conf ([id] + [launcher] stanzas) from 1.0.3 -> 1.0.4, kept in sync as this app requires.
• No CI previously validated builds or ran AppInspect on this repo.
  • Add .github/workflows/validate.yml, calling Bre77/splunk_nats's reusable _reusable-build-appinspect.yml in its build_command mode (./.build.sh, which runs pnpm install && pnpm build and writes badrcm.spl to the repo root).
  • Node 20 + corepack provisioned for pnpm (pinned via package.json packageManager); Splunk Python 3.9 provisioned for AppInspect.
  • Gated on fail_on: errors - verified locally: 0 errors, 0 failures, only pre-existing warnings (missing [shclustering] stanza, check_for_updates on a private app, public IPs in a source map) that don't block a private-app republish.
  • Deliberately no publish/upload step or secrets - publishing to Splunkbase stays a separate, human-triggered step.

What Changed

• package.json: version 1.0.3 -> 1.0.4
• src/main/resources/splunk/default/app.conf: [id] and [launcher] version 1.0.3 -> 1.0.4
• .github/workflows/validate.yml: new build + AppInspect CI on push to main and on PRs
• AGENTS.md: added a ## Release section documenting the two version locations and the new CI workflow

Testing

• ./.build.sh run locally: pnpm install && pnpm build succeeds (only non-fatal webpack asset-size warnings), produces badrcm.spl at repo root
• splunk-appinspect inspect badrcm.spl --mode precert run locally against the built package: 0 errors, 0 failures, 7 pre-existing warnings
• CI run on this PR (build + AppInspect via the reusable workflow)