Greptile review follow-ups: - Validate ran twice per startup (urfavecli Before hook + action path) on the same CLI, and the second pass saw the defaults the first pass filled in — the gateway URL, the firebase account — as operator-set values and rejected valid configurations. Validate now runs its checks exactly once per CLI and is a no-op afterwards, which also fixes the pre-existing node-startup variant of this for --livepeer-gateway and --firebase-service-account-file users. validate-config's action no longer re-validates for the same reason. - An unreadable --firebase-service-account-file is now reported by CheckConfig, so it is collected alongside every other problem instead of being hidden behind the first failure.