tp: validate runner commands before opening a session

[cwschroeder]

The TP runner currently opens a session before rejecting an unknown command or parsing failfast numbers. A typo can therefore start fate threads and return without closing their session. This patch validates command syntax before configuration, CUDA and session startup.

It also rejects unknown failfast modes instead of treating them as fatal injections. Documented defaults and the explicit HOLD=0 host-only guard are preserved. Session ownership and transport code are unchanged.

Validation at 602a0fd4e1d621cf0715d01a2b466497dc3b4bb7:

• Negative control: 16 entry-point failures on the old dispatch with the new tests.
• Candidate CI: all No GPU commands passed; all six current-head checks are green.
• Local Zig 0.17.0: parser Debug/Fast 2/2 passed, Linux safe cross-build 5/5, whole-tree format passed, lean 517 base/517 candidate/zero new.
• Read-only final source review found no material issue. No GPU, model or transport execution.

Pinned upstream PR ashhart#636 base: 46161ac46a4448e4b7179fba84e3554537a43319; main remains 6ee828c24bf802cdd73507d6fc60bb27a82c0d66. This fork PR provides validation and a bounded patch for the existing upstream thread.

Patch and source/compiler/binary hashes.