Add typed tool arguments and the form checks for paths, hosts and URLs

Implemented brokerd::args: a pure module (no I/O, no clock) that parses tool
arguments into a typed ToolArgs and checks the form of paths, hosts and URLs.
Four private deny_unknown_fields structs drive parse and canonical_json; path,
cwd and url are validated as written and never normalised. All 13 args tests
pass and make gate prints gate: ok.

Implemented-By: OpenCode session (model recorded in docs/implementer-log.md)

crates/brokerd/src/lib.rs

@@ -1,5 +1,6 @@
 //! The broker: the only role that holds authority.
 
+pub mod args;
 pub mod config;
 pub mod policy;
 pub mod runner;