attractor run: add --validate/--preflight preflight-only mode

[danshapiro]

Problem

kilroy attractor run currently performs preflight and then starts the real run. Operators need a way to run only preflight checks when they want to verify setup safely before spending runtime/provider cost.

Proposal

Add a --validate flag (with --preflight as a synonym) to kilroy attractor run that:

• Runs the same preflight path used by a real run.
• Produces the same preflight artifacts/output (for example preflight_report.json where applicable).
• Exits after preflight completes.
• Does not create or start the real execution run.

Expected CLI behavior

• kilroy attractor run --validate --graph <file.dot> --config <run.yaml>
• kilroy attractor run --preflight --graph <file.dot> --config <run.yaml> (alias of --validate)

Acceptance criteria

• Preflight-only mode fails with non-zero exit code when preflight fails.
• Preflight-only mode exits 0 when preflight passes.
• No run execution begins in preflight-only mode.
• Help/usage text documents both --validate and --preflight aliasing.
• Add tests covering:
  • --validate path
  • --preflight alias path
  • guard against starting execution in preflight-only mode