Reject mixed candidate preflight failures

Existential matching accepted an entire failed preflight when any finding or text fragment indicated an unsupported check, even when the same result contained malformed data or a real configuration error. OCM could then finalize and bind the invalid candidate.

Requires failed JSON with zero executed checks, a numeric skipped count, and exactly one matching error finding; rejects missing, mixed, contradictory, or malformed results. Text fallback accepts only an unambiguous unsupported command or option with usage guidance.

• Stops upgrades before finalization and binding publication when candidate validation contains a genuine error.
• Retains compatibility for older candidates whose sole failure is an unsupported command, option, or named check.
• Applies the same fail-closed boundary to runtime-bound and launcher-bound upgrade paths.

• A built-CLI regression switched environments on unchanged production code after mixed unsupported and invalid-configuration findings; the candidate rejects it and retains `old-local`.
• Coverage includes sole-unsupported, registry skipped counts, mixed findings, missing fields, contradictory status, malformed JSON, appended fatal text, and supported passing candidates.
• All nine final cross-platform CI jobs passed, including macOS/Linux suites and installation smoke checks. The verified merge commit credits Goutam Adwant.
• Proof used isolated synthetic candidate/service fixtures, not a production gateway or credentials. One combined native-upgrade preparation case had an empty test-HTTP response but passed in isolation before exact-head CI completed successfully.