boot: validate --install-ipa before startup

[TastyHeadphones]

Summary

• fail fast when --install-ipa is combined with --dfu
• validate the requested package path before VM startup
• reject unsupported package types before the boot flow begins
• clarify in --help that --install-ipa is unavailable with --dfu

Validation

• make build

Notes

• Attempted to exercise the new CLI validation paths directly, but the built binary is killed with exit code 137 in this local environment even for --help, so runtime validation could not be captured here.