test: CLI program validation and corpus validation agree on canonical-ID checks #460

Parent: #451

Problem

CLI program.validate() skipped the canonical-ID validation the corpus path runs, so surplus arguments passed (#439). The CLI and library validation entry points must enforce the same contract.

Scope

Add tests asserting the CLI validation entry point and the corpus validation path give the same accept/reject outcome on the same programs, including surplus and missing arguments and unknown canonical IDs.

Non-goals

Redesigning validation entry points.

Acceptance criteria

• For the same program, both entry points accept or reject identically.
• The test fails if either entry point skips a check the other runs.
• Any disagreement found is fixed by sharing the established check.