fix(cli): make batch validate like render and report what actually happened

[LeadcodeDev]

Refs #142 — CLI workstream, second of three. Four confirmed findings, all in commands/batch.rs.

batch renders N videos in one shot. It was the one command path that told the truth about none of them.

Silent success on worker panic

let _ = h.join(); carried the comment "panics in threads are surfaced as failures below". Nothing below ever inspected the join result, and the worker closure's bookkeeping runs only on the Ok/Err return path — which a panic skips entirely. So a batch where every render panicked printed Batch complete: 0/2 succeeded., left an empty output directory, and exited 0.

Panics are now pushed onto failures with a readable payload. A final guard fires if success_count + fail_count != total — defence in depth against a future row going neither counted nor reported.

Geometry validation bypassed

Preflight ran a parse-only dry load, so batch skipped the schema + geometry pass render applies. The same template that render rejects with 1 geometry violation(s) sailed through batch and produced an overflowing video, reported as success.

validation::run_checks now runs per row with render's no-flag defaults, failing the whole batch before a frame is drawn. This is the mode that renders in bulk — it must not be the one that skips the gate CLAUDE.md makes mandatory.

Writes outside --output-dir

--name-template interpolates values straight from the data file, so a row carrying {"id":"../secret/escaped"} or {"id":"/tmp/absolute"} wrote outside the output directory. Names are rejected in preflight when they contain a parent-dir, root or prefix component.

Lexical, not canonicalising — deliberately. canonicalize() fails with ENOENT on a subdirectory that does not exist yet, which would have broken the legitimate {lang}/{id}.mp4 form the existing field_placeholder_resolved test covers. A regression test pins that nested-output case alongside the two escape cases.

Notes for the reviewer

The two fixes interact, and the interaction is why one test looks different from the audit's reproduction. Wiring geometry validation into preflight made the audit's original panic repro (odd 321×241 dimensions) unreachable — batch now rejects those scenarios before spawning a thread. The panic-capture test therefore uses a different trigger (70000×70000, which overflows u32 arithmetic in the openh264 path) to exercise the same mechanism. The batch path gained a second closed panic vector as a side effect.

No --lenient / --no-validate / --strict-anim parity with render. The audit suggested it; adding it needs new fields on Commands::Batch in lib.rs. Deliberately not done: bulk rendering is exactly where an escape hatch from validation costs the most, so batch is always strict. Additive later if a real need appears.

Verification

cargo fmt --all --check, cargo clippy --workspace --all-targets -- -D warnings, cargo test --workspace — 752 passed, 0 failed, re-run by the orchestrator on the integrated tree. 9 new tests, each written red first against the audit's reproduction.