[aniaisec]

PR 01 from the adoption implementation plan fixes validation and test gates that could report success for invalid numeric requests or unusable browser environments.

• Derive the schema command filename from SCHEMA_VERSION while preserving --out and the current artifact schema.
• Reject non-finite decimal inputs and invocation time budgets before opening a surface; preserve sensitive input masking and assert finite output parsing.
• Read and validate demo evidence, requiring discovery model-call records and zero model calls during replay, including resumed runs.
• Add --require-browser, preserve original launch errors, skip only an explicitly missing executable in optional mode, and fail strict runs with no executed browser tests. Enable strict mode in browser CI.

Validation: Full local suite passed: 975 tests, zero skips, in 20m22s, including Windows desktop, browser, security and the seven-stage demo. Ruff lint and formatting and strict mypy for default and win32 targets passed. All GitHub quality and browser CI jobs passed on d2fcdd6, including deterministic benchmark smoke and the full security benchmark.