fix(mpc): reject invalid raw grid limits

[frahlg]

Summary

• validate raw MPC fuse and export limits before slot clamping can mask invalid values
• keep the latest accepted plan and skip both planners, decision ID allocation and diagnostic writes when a raw limit is invalid
• use the same validated limit snapshot for primary and Go-fallback slot construction

Evidence

On the old base, a negative fuse and negative, NaN or infinite export limits reached planning after clamp logic turned them into disabled or fuse-only limits. The Service tests then published a new plan. The Go-DP repro also replaced the prior plan for a NaN export limit.

After this change:

• focused regression tests pass 100 times
• focused race tests pass 25 times
• the full MPC suite and full MPC race suite pass
• go vet ./internal/mpc passes
• make verify-all passes, including 134 Python tests, all Go tests, optimizer contracts, full stack, migration checks, vet, builds and linux/arm64, linux/amd64 and windows/amd64 cross-builds
• two independent reviews found no P0-P3 issue

Scope

This PR hardens the MPC Service boundary only. Config and dispatch still need their own finite/range checks, but open PRs currently own those files. The changeset does not claim end-to-end config or hardware enforcement.

Part of #885.