Fix GraderConfig.UnmarshalYAML to reject unknown fields at grader entry level

[Copilot]

LoadBenchmarkSpec sets KnownFields(true) on the top-level decoder, but GraderConfig.UnmarshalYAML was calling node.Decode(&raw) which doesn't inherit that setting — unknown keys alongside type, name, weight, etc. were silently accepted.

Changes

• internal/models/spec.go: Changed GraderConfig.UnmarshalYAML to marshal the node back to bytes and re-decode with an explicit yaml.NewDecoder + KnownFields(true), matching the pattern already used by decodeYAMLNode for the config: sub-object.
• internal/models/spec_test.go: Added two new cases to TestLoadBenchmarkSpec_StrictYAML — one for an unknown field at the grader entry level and one for an unknown field inside config:.

# Previously silently accepted — now rejected
graders:
  - name: my-grader
    type: text
    unknown_grader_field: oops   # ← was ignored, now errors
    config:
      contains: ["hello"]
      unknown_config_field: oops  # ← already rejected via decodeYAMLNode, now explicitly tested

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.