fix(bench): validate num_frames > 0 and warmup_frames >= 0

Copilot review on PR #129 caught that the per-frame stats path
unconditionally allocates / sorts / divides by num_frames, which
would OOB-access sorted[num_frames - 1] and divide by zero if a
caller passed 0 or a negative number.  Both come from atoi() which
returns 0 on garbage input, so this was reachable.

Validate both at parse time and exit with a clear error before
allocating anything.

Co-Authored-By: Claude Opus 4.7 <[email protected]>

Author: JoeMatt

test/tools/test_benchmark.c

@@ -256,6 +256,17 @@ int main(int argc, char **argv)
          num_frames = atoi(argv[i]);
    }
 
+   if (num_frames <= 0)
+   {
+      fprintf(stderr, "ERROR: num_frames must be a positive integer (got %d)\n", num_frames);
+      return 1;
+   }
+   if (warmup_frames < 0)
+   {
+      fprintf(stderr, "ERROR: --warmup must be >= 0 (got %d)\n", warmup_frames);
+      return 1;
+   }
+
 #ifdef __APPLE__
    /* Initialize timebase for mach_absolute_time conversion */
    mach_timebase_info(&timebase_info);