[Code scan] Validate TensorFlow multi-device descriptor/neighbour dimensions before raw kernels

Found during a Codex global scan of `deepmodeling/deepmd-kit` at commit `73de44b1f94471b2e3bdb6b11f57b34d7bc791bb`.

## Problem

Several TensorFlow multi-device force/virial ops derive `ndescrpt` and `nnei` with integer division, then rely on `assert` for important shape relationships such as `nnei * 4 == ndescrpt`.

Evidence:

- `prod_force_multi_device` derives both values by division and checks key invariants only with `assert`: https://github.com/deepmodeling/deepmd-kit/blob/73de44b1f94471b2e3bdb6b11f57b34d7bc791bb/source/op/tf/prod_force_multi_device.cc#L91-L130
- `prod_force_grad_multi_device` has the same release-only gap before raw pointer use: https://github.com/deepmodeling/deepmd-kit/blob/73de44b1f94471b2e3bdb6b11f57b34d7bc791bb/source/op/tf/prod_force_grad_multi_device.cc#L74-L127
- `prod_virial_grad_multi_device` also relies on `assert(nnei * 4 == ndescrpt)` after allocating and before dispatch: https://github.com/deepmodeling/deepmd-kit/blob/73de44b1f94471b2e3bdb6b11f57b34d7bc791bb/source/op/tf/prod_virial_grad_multi_device.cc#L80-L141

## Impact

Release builds compile out `assert`. Malformed tensor widths that are not exact multiples of `nloc`, or descriptor widths that do not match the expected neighbor stride, can reach raw CPU/GPU kernels with inconsistent shapes and cause out-of-bounds reads/writes.

## Suggested Fix

Convert descriptor/nlist divisibility and `ndescrpt == nnei * stride` checks to `OP_REQUIRES` before allocation and kernel launch. Add TensorFlow custom-op tests passing inconsistent `net_deriv`, `in_deriv`, `rij`, and `nlist` widths and expecting `InvalidArgument`.