v1.7e — audit fixes (-ver/-dry in tovyCIP, strict numeric flags)

Audit fixes — -ver / -dry now work in tovyCIP, strict numeric flags

P0 — silent bugs

1. -ver was silently ignored in the default tovyCIP path. Before
   v1.7e, passing -ver with a default tovyCIP encode took exactly
   the same wallclock as without it — verify ran zero work even though
   the flag was accepted. Fixed by routing the encoder output through
   an in-memory buffer (new optional out_bytes parameter on
   compress_tovycip_archive) so -ver can decompress to a temp dir
   and byte-compare against the original PNG (or pixel-compare under
   -ldf).

2. -dry was silently ignored in the default tovyCIP path. Files
   were written to disk regardless. Same plumbing: the encoder no
   longer writes when dry_run is set, but still tallies totals from
   the in-memory buffer so the summary line stays accurate. -ver -dry
   now does a full round-trip verify without touching disk.

P1 — strict flag validation

3. -m, -th, -nofsep=, -zl= now reject non-numeric and
   out-of-range values with a clear stderr message and exit 2.
   Previously e.g. -mZ silently became a no-op (atoi returned 0,
   branch matched but did nothing) — inconsistent with the existing
   unknown flag: X → exit 2 policy. Removed a duplicate -nofsep=
   handler.

P2 / docs / UX

4. collect() recursion now picks up .tcip and .ppgs files
   (legacy archive extensions). Previously -r over a tree containing
   those silently skipped them, even though detect_type would have
   dispatched them correctly.

5. Banner subtitle now reads tovyCIP backend (kanzi BWT + zstd-19-long)
   instead of brute-force zlib match + solid LZMA (the old default).

6. Help text: -perfile no longer documented as (no-op); describes
   the legacy LZMA opt-out it actually performs.

7. Help text: -kpng-max no longer claims archive use case
   (archives were removed in v1.7) — explains the per-file ratio /
   decode trade-off instead.

8. Help text: -sfth mentions parallel kanzi encode in the tovyCIP
   path, not just MT-LZMA.

9. Help text: -deep claim of ~2x slower / ~6% smaller softened to
   reflect that on libpng-default encoders it's effectively a no-op
   (match always found on candidate 0); helps a few percent on exotic
   encoders.

10. -od without a glued path now prints
    missing value: -od<path> (glue the path: -od/some/dir) instead
    of unknown flag: -od.

11. Single missing file now shows the actual path:
    ERROR missing file: /path/to/file.png instead of
    ERROR 1 missing file(s).

Notes

• Windows binary not shipped this release (no Windows host available
  during the cycle). Linux x86-64 only. Windows users on v1.7d
  experience the -ver / -dry bugs too — workaround until v1.7e
  Windows lands: use -m6 (legacy LZMA path) where both flags work
  correctly.

• Compression algorithm and wire format unchanged from v1.7d. v1.7d
  output decompresses byte-exact under v1.7e and vice versa.