fix(cli): validate q server port arguments

[belowzeroff]

What changes for users

rayforce -q and rayforce --q-serve now fail clearly and consistently when the port is missing or invalid. The process prints a direct diagnostic and exits with status 2, instead of reporting a misleading file-open/unknown-option error or continuing with exit status 0. Arguments after -- remain application arguments and are not interpreted as Q-server flags.

What changed

• Propagate Q-server startup failures from the embedded rayforce binary.
• Validate missing, non-numeric, and out-of-range ports through the Q CLI parser.
• Stop Q-flag scanning at the application-argument separator.
• Add self-tests and document the CLI contract.

Validation

• Full make test with local fresh Rayforce core: passed (codec, exchange, server round-trip, malformed-frame, real-q interop, client, auth, and push suites).
• Q CLI self-test: passed.
• Real binary: -q 70000 -> exit 2; -q -> exit 2; --q-serve -> exit 2; -- -q 70000 -> exit 0.
• Release build with -Werror: passed.
• Based on fresh origin/master (1eabaf4).

[protocolstardust]

Reviewed and merged (4322f53).

What was checked

• The two sed anchors still match the current core main.c (int rc = 0; and done: are both in main, so rc = 2; goto done; is valid there).
• Built the full binary against core 31f45a7 and exercised it:

invocation	exit	stderr
rayforce -q 70000	2	q: invalid port 70000 (expected 1..65535)
rayforce -q	2	q: missing port after -q (expected 1..65535)
rayforce --q-serve abc	2	q: invalid port abc (expected 1..65535)
rayforce -- -q 70000	0	(app args, not parsed)
rayforce -q 61999	serves	q: listening on 61999

• The new --q-cli-selftest leg passes in the suite.

One consequence to be aware of: the Makefile patch now depends on rc / done: existing in the core's main.c. If the core renames them the make rayforce build fails loudly rather than silently ignoring the port error, which is the better failure mode.