#3044 artifact: reject invalid tensor bounds and architecture failures in --check

Description

## Title
Resolves #3043

## Summary
`strata-gguf --check` returns success after an architecture failure, and unsigned gap/byte arithmetic can accept a tensor outside the file or a tensor whose byte count overflows. These cases now return status 1.

## What changed
- Use the existing overflow-safe `tensor_payload_bytes()` helper and check file bounds before subtracting an offset in the standalone CLI.
- Return status 1 when the architecture guard fails.
- Add a CPU-only CTest invoking the actual CLI entry point on nine synthetic cases: valid input, inspection-only behavior, unsupported/missing architecture, wrapped and ordinary out-of-file offsets, overflowing byte count and truncation.

Inspection without `--check`, the reader API, inference code, GPU kernels, unknown-type reporting and the existing padding bracket are unchanged.

## Validation
Linux x86_64, GCC 14.2.0, upstream base `477ac13c`:
- CMake build with `STRATA_WERROR=ON`: strata-gguf, gguf_cli_test, gguf_reader_test, gguf_split_test, gguf_geometry_test and model_family_test.
- CTest: all five selected tests passed.
- The new test against unchanged upstream fails for unsupported/missing architecture, wrapped offset and overflowing byte count.
- Old/new executable comparison: identical exit codes, stdout and stderr bytes for a valid file with `--check` and three inspection-only fixtures.
- `git diff --check` passed.

## Extra Notes
No model inference, Windows runtime or CUDA/HIP/SYCL engine builds were run. The changed production source is the standalone host-only CLI target; GPU backend sources are untouched. Searched open issues and PRs; #2288 and #2475 address different readers.