fix(cli): make batch validate like render and report what actually happened (#146)

`batch` produces N videos in one shot, and it was the one path that told
the truth about none of them.

With `--jobs > 1` a worker panic was swallowed: `let _ = h.join()` was true
to its comment ("panics are surfaced as failures below") in name only —
nothing below inspected the join result, and the closure's bookkeeping only
runs on the return path a panic skips. A batch where every render panicked
printed "0/N succeeded" and exited 0. Panics are now recorded as failures,
with a final guard should a row ever go neither counted nor reported.

Preflight ran a parse-only dry run, so `batch` skipped the schema and
geometry pass `render` applies — the viewport-overflow gate CLAUDE.md makes
mandatory was bypassed by the very mode that renders in bulk. It now runs
`validation::run_checks` per row, with render's no-flag defaults, and fails
the batch before a single frame is drawn.

`--name-template` interpolates values straight from the data file, so a row
carrying `../escaped` or `/tmp/absolute` wrote outside `--output-dir`.
Names are now rejected in preflight when they contain a parent-dir, root or
prefix component. The check is lexical rather than canonicalising: a
canonicalize-and-compare fails with ENOENT on a subdirectory that does not
exist yet, which would have broken the legitimate `{lang}/{id}.mp4` form.

Author: LeadcodeDev