uttrflow-eval transcribe crashes on a negative --findings or --passage-limit, and tells people to raise a --passages option that does not exist

## What happens

In `Sources/uttrflow-eval/TranscribeCorpus.swift`:

- `--findings` (line 50) is passed to `ReportBreakdown.topFindings(_:)` (`Sources/UttrflowEval/ReportBreakdown.swift:136-140`). With `-1`, `all.count > limit` is true and `all.dropFirst(-1)` traps.
- `--passage-limit` (line 53) is passed to `failed.prefix(passageLimit)` (line 447) and `worst.prefix(passageLimit)` (line 459). `prefix` with a negative count traps.
- Lines 451 and 480 print "raise --passages to see them". The option is `--passage-limit`; `uttrflow-eval transcribe --passages 3` answers `Error: Unknown option '--passages'`.

`validate()` (line 68) checks the engine and the baseline flags but neither number. Both traps happen only after the whole corpus has been transcribed, so the run is lost.

A negative count trapping in `prefix`/`dropFirst` was confirmed with a three-line Swift program (exit 133).

## Why it matters

A corpus run takes minutes; a typo such as `--findings -5` throws all of it away with a crash rather than an error at the start. The hint sends people to an option that is refused.

## Acceptance criteria

- `validate()` refuses `--findings` and `--passage-limit` below 0 with a message naming the option, before any audio is read.
- `0` keeps working and prints no findings or passages.
- Both hints name `--passage-limit`.
- A unit test in `Tests/UttrflowEvalTests/` covers `topFindings(0)` and a limit larger than the list; if `topFindings` is made to clamp a negative limit as well, test that too.

## Where to start

- `Sources/uttrflow-eval/TranscribeCorpus.swift` lines 50-77, 451, 480.
- `Sources/UttrflowEval/ReportBreakdown.swift:136`; the tests for it are in `Tests/UttrflowEvalTests/` (`git grep -l topFindings Tests`).
- `validate()` in `Sources/uttrflow-dev/Bench.swift:32` is the pattern to follow.
- Read [CONTRIBUTING.md](https://github.com/uttrflow/uttrflow-swift/blob/main/CONTRIBUTING.md) first, and say on this issue that you are taking it.
- Before pushing, run `make verify` (with `DEVELOPER_DIR` pointing at Xcode 26.6 or later). It is the same command CI runs.

**Size:** XS to S, about 1 hour.

Read CONTRIBUTING.md, then inspect validate() and the --findings/--passage-limit handling in Sources/uttrflow-eval/TranscribeCorpus.swift. Review topFindings(_:) in Sources/UttrflowEval/ReportBreakdown.swift and its tests under Tests/UttrflowEvalTests/. Done means negative values are rejected before transcription, zero remains valid, both hints say --passage-limit, and the requested limit cases are tested; run make verify.

Written by the indexing model from the issue text.