uttrflow-bakeoff reload-leaks --checkpoints 0 crashes instead of refusing the value

## What happens

`Sources/uttrflow-bakeoff/ReloadLeaks.swift:24-27` accepts any ascending list of integers. A checkpoint of `0` (or a list starting with `0`) passes the check, the reload loop at line 37 never runs, `times` stays empty, and line 49 reads `sorted[sorted.count / 2]` from an empty array, which traps with an index out of range. A negative checkpoint does the same.

## Why it matters

A measuring tool that crashes on a typo gives no reason. It should say which value is wrong, as the command already does for an unknown `--model`.

## How to check

Read lines 24-50: with `--checkpoints 0`, `totals == [0]`, the `while done < total` loop is skipped, and `sorted` is empty at line 49. Running it needs the MLX build (`make bakeoff ARGS="reload-leaks --checkpoints 0"`, which downloads nothing if the suggestion model is already installed), but the reading of the code is enough to confirm it.

## Acceptance criteria

- `--checkpoints` values below 1 are refused with a `ValidationError` that names the allowed range, before any model is loaded.
- The existing messages for an unknown model and for a non-ascending list are unchanged.
- The median line can never index an empty array.

## Where to start

- `Sources/uttrflow-bakeoff/ReloadLeaks.swift` (lines 24-27 and 46-50)
- Look at `validate()` in `Sources/uttrflow-dev/Bench.swift:32` for the pattern the other tools use.
- Tests to extend: there is no test target for `uttrflow-bakeoff`. If you move the parsing into a small static function, you may test it from a new file; otherwise say in the pull request how you checked it.
- Before pushing, run `make verify` (export DEVELOPER_DIR=/Applications/Xcode.app/Contents/Developer first). It is the same command CI runs, and it enforces the 95% coverage floor per module.
- Read [CONTRIBUTING.md](https://github.com/uttrflow/uttrflow-swift/blob/main/CONTRIBUTING.md) first, and say on this issue that you are taking it.

**Size:** S, about 1-2 hours.

Read CONTRIBUTING.md, then inspect Sources/uttrflow-bakeoff/ReloadLeaks.swift lines 24-27 and 46-50, comparing validation with validate() in Sources/uttrflow-dev/Bench.swift:32. Check the --checkpoints 0 path and extend or add focused coverage as appropriate; run the documented command and make verify. Done means invalid values are refused before model loading, existing validation messages remain unchanged, and the median path cannot index an empty array.

Written by the indexing model from the issue text.