[BUG] pptx: add/validate accept adjust-value <a:gd> on presets without adjust handles (rect/ellipse) — PowerPoint reports file as corrupt

## Summary

`add --type shape` happily writes an adjust-value `` into a preset geometry that has **no adjust handles** (e.g. `rect`, `ellipse`), and `validate` reports no errors — but **PowerPoint refuses to open the file, reporting it as corrupt**. This is a silent data-corruption path: all officecli-side checks stay green.

## Repro (v1.0.136, macOS)

```bash
officecli create repro.pptx
officecli add repro.pptx / --type slide
officecli add repro.pptx '/slide[1]' --type shape \
--prop geometry=rect --prop x=1cm --prop y=1cm --prop width=4cm --prop height=2cm \
--prop text="test" --prop adj="adj:val 14000"
officecli validate repro.pptx
# -> "Validation passed: no errors found."
```

Resulting slide XML:

```xml

```

Opening this file in desktop PowerPoint triggers the "repair/corrupt" dialog.

## Expected

Two layers of defense, either of which would have caught this:

1. **`add`/`set` should reject** adjust values whose `name` is not legal for the target `prst` (e.g. `rect`/`ellipse` accept none; `roundRect`/`chevron`/`homePlate`/`triangle` accept `adj`; `round2SameRect` and the arrow family accept `adj1`/`adj2`, etc.).
2. **`validate` should flag** existing `` entries whose name is not in the preset's `avLst` as defined by ECMA-376 `presetShapeDefinitions.xml`.

The full legal-handle table is mechanical to derive from `presetShapeDefinitions.xml` (each preset's `` lists its `gd` names), so this can be a static lookup table.

## Impact

High — the file passes `validate`, unzips fine, and renders fine in `view html`/`screenshot`, yet is unopenable in PowerPoint. Agents driving officecli have no way to detect the problem short of regex-auditing the raw XML themselves.

Inspect the add/set and validate shape-handling entry points, then compare preset geometry names with the legal gd names in ECMA-376 presetShapeDefinitions.xml. Reproduce the rect example and verify that invalid handles are rejected on write and reported by validate, while valid handles continue to work.

Written by the indexing model from the issue text.