feat(cli): add strict preset file loading

[bearmug]

Summary

• add mutually exclusive --preset-file <path> support while preserving built-in --preset <name> behavior
• validate a strict, versioned schemaVersion: 1 preset document with built-in parity and operator-specific value contracts
• load files through a nonblocking descriptor with regular-file, UTF-8, and bounded 1 MiB checks
• emit redacted provenance (basename + SHA-256) without exposing absolute paths
• document the file schema and align the published operator/type contracts

Safety and compatibility

• no URL, include/import, directory, or implicit repository discovery support
• filesystem access remains in the CLI adapter; screening receives a parsed preset document
• source exclusivity is checked before any file access
• built-in file-schema equivalents are covered by tests
• FIFO, symlink, malformed JSON, invalid UTF-8, oversized file, prototype operator, and path-redaction regressions are covered

Verification

• npm run build
• npm test — 217 passed
• git diff --check
• Codex review: clean
• final independent reviewer: CLEAN