feat(pxq): strict-mode AST validator

[trendvidia]

Summary

Closes the last item from the original pxq design doc. When a
top-level message type is bound to the document — via -m, an @type
directive, or one of the four @proto shapes — the parsed gojq query
AST is walked before compile, and any direct field-chain access that
doesn't resolve against the schema is rejected with a did-you-mean
hint.

Demo

$ pxq -p trades.proto -m trades.v1.Trade '.symbool' march.csv
pxq: strict-mode: unknown field "symbool" on trades.v1.Trade (did you mean "symbol"?)

$ pxq '.inner.t' nested.pxf    # @type bound from the input
pxq: strict-mode: unknown field "t" on strict.v1.Inner (did you mean "s"?)

$ pxq --strict '.x' loose-file.pxf
pxq: --strict requires a top-level message type (pass -m fully.qualified.Name,
set @type in the document, or run `pxq infer-schema` first)

New CLI flags

Flag	Effect
-m, --message <FQN>	Bind the document root to a fully-qualified message name; required for --strict when no @type is present
--strict	Force strict mode; errors when no root type is bound
--loose	Force loose mode (skip validator) even when bound

--strict and --loose are mutually exclusive.

What the validator catches (and what it doesn't)

The contract is "no false positives, some false negatives": a query
that passes validation is guaranteed not to type-error on the field
names the validator can see; dynamic access patterns fall back to
gojq's runtime behaviour.

Validated:

• Direct field chains rooted at identity (.foo, .foo.bar, …)
• Both halves of a | pipe
• Nested submessage descents (Outer.inner.s)

Not validated (passes through to runtime):

• Array indexing and iteration (.tags[0], .tags[])
• Function calls (pxf_directive(...), length, …)
• Object/array constructors ({a: .x}, [.x, .y])
• Comparison type-checking (.age > "30" where age is int32) — out
  of scope; would need a full type inferer

Resolution rules

effectiveMode × resolveRootType encode the README's behavior:

• Auto-mode: bound → strict, unbound → loose
• --strict + unbound → actionable error pointing at -m / @type /
  pxq infer-schema
• --loose: always loose, regardless of binding
• --message wins over @type; @type falls back to nothing

Test plan

• go build ./... clean
• go test ./cmd/pxq — 106 tests pass (86 from prior + 20 new):
  • effectiveMode × {auto, strict, loose} × {bound, unbound}
  • Validator: known/unknown direct fields, did-you-mean radius
    cutoff, nested chains, chain-past-scalar permissiveness, pipe
    halves, non-path Terms permissive, nil-root no-op,
    array-index-then-field permissive
  • resolveRootType: --message-wins, @type fallback, no-binding
    nil, no-schema nil
  • End-to-end through runQuery: strict rejects at compile time,
    loose runs typo to null
• CLI smoke tests for the four observable behaviors
• README updated to describe the bound/unbound semantic + the
  three new flags

Future work (not in scope)

• Comparison type-checking (.age > "30" where age is int32)
• Tracking element types through array indexing and pxf_directive
  for transitive validation across more access patterns

This wraps the original pxq design doc — every item the README v1
described now exists in code.