Reject invalid case exclusions outside a target's suites

## Current evidence

`tools/case_manifest.py` validates every `exclude` entry as a safe path that merely exists under `tests/cases`. The runtime selector later compares source-file paths against `target.exclude`.

An exclusion can therefore point to a directory or to a case from another target's OS/architecture and still pass manifest validation, even though it can never exclude a source selected for that target.

## Scope

- Require each exclusion to name a case source belonging to one of the target's selected suites.
- Reject directories and unrelated existing paths.
- Keep the existing safe-path and duplicate-entry validation.
- Preserve valid exclusions for shared, architecture-shared, and target-specific cases.
- Keep the broader runtime-portability work in #459 separate.

## Completion criteria

- Unit tests reject an exclusion from another target suite.
- Unit tests reject a directory passed as an exclusion.
- Valid source exclusions continue to remove the intended runtime case.
- Existing valid manifests and generated matrices remain unchanged.

Start in tools/case_manifest.py and inspect the manifest validation, then run the existing unit tests covering exclusions and runtime selection. Done means exclusions from other target suites and directories are rejected, while valid shared, architecture-shared, and target-specific source exclusions still work without changing valid manifests or generated matrices.

Written by the indexing model from the issue text.