fix(mpc): reject invalid planning physics

[frahlg]

What changed

• Validate effective slots, fleet, storage and loadpoint physics before either planner runs.
• Require the external and Go fallback loadpoint views to describe the same asset.
• Use one PV uncertainty sample per replan and reject invalid values instead of masking them.
• Keep the prior plan when inputs are invalid or when Go DP would have to invent an in-band starting SoC.

Why

Core and the Python optimizer used different defaults and clamps for malformed values. Unknown modes, non-finite values, invalid efficiencies, stale EV fallback data and out-of-band recovery could therefore reach one planner but not the other. The service now fails closed at their shared boundary.

Validation

• make verify-all
• focused MPC regression tests: 100 runs
• focused MPC race tests: 25 runs
• full go test ./internal/mpc
• full go test -race ./internal/mpc
• go vet ./internal/mpc
• three independent read-only reviews with no remaining P0-P3 findings

Part of #885.