Validate compressed-SLC inputs and fix forward-mode stack-depth count

[mgovorcin]

Summary

Validates compressed-SLC (CCSLC) inputs up front, and fixes an off-by-one in the
forward-mode network guard that let a too-shallow stack through into an
IndexError deep inside dolphin.

Two of these were found by running the delivery package: one is a genuine crash
on a valid-looking config, the other cost ~90 s of processing before failing with
an unactionable pydantic traceback.

The bugs

1. Forward-mode stack-depth guard counted compressed SLCs (real crash).
_create_forward_mode_network builds a manual-index interferogram network
reaching back nearest_n + 1 positions, and asserted the stack had at least that
many files. But dolphin.workflows.wrapped_phase.run collects that network's
inputs by globbing only the real-date phase-linked outputs ("2*.tif") —
compressed-SLC outputs are globbed separately ("compressed*tif") and never
enter the list. So a CCSLC adds no depth, and a stack of e.g. 2 CCSLC + 3 real
passed a nearest-3 guard needing 4, then died with:

IndexError: list index out of range
  in dolphin.interferogram._make_ifg_pairs

Now counts real SLCs only.

The same guard also sampled a single burst as a template for the whole stack
(burst_id = next(iter(burst_to_file_list))), on the assumption that every burst
shares the same acquisition dates. A short non-first burst therefore reached the
same IndexError. Every burst is now checked, and the message names the shallow
ones: ... in every burst, but found only -- t027_056726_iw1: 3.

2. CCSLC/real-CSLC date conflicts weren't checked at all.
Two malformed shapes were accepted by disp-s1 and only rejected mid-workflow by
dolphin's ministack construction, as a pydantic ValidationError with no
indication of which input was at fault. In historical mode that happens after
mask extraction and PS selection have already run -- the MiniStackPlanner
construction that raises is the first statement in run_wrapped_phase_sequential,
so the cost is paid before any phase linking starts.

• A real CSLC sharing a date with its own burst's CCSLC reference date (1001).
• A CCSLC whose reference date reaches past the real CSLCs it's paired with (1002).

3. Forward mode accepted a burst with real CSLCs but no CCSLC of its own
(2000). Each burst is processed independently, so that burst gets an empty
compressed-SLC reader downstream and fails in disp_s1._ps.run_combine.

Mode-awareness of 1002

The boundary a CCSLC must predate depends on how many products the mode emits:

mode	CCSLC reference date must predate	why
DISP_S1_FORWARD	the latest real date	only the newest date gets a product; earlier reals are context
historical (and any other type)	the earliest real date	every real date gets a product, so a CCSLC reaching between two of them double-counts the earlier one

This relies on compressed_slc_plan="last_per_ministack", under which a CCSLC's
reference date is by construction its end date. That is DISP-S1's setting, not
dolphin's default: every delivered configs/algorithm_parameters_*.yaml sets it,
while dolphin's own PhaseLinkingOptions defaults to always_first (under which
the identity does not hold). That's stated explicitly at the check.

Error codes

1000–1002 apply in every mode; 2000–2001 are forward-only.

code	check
1000	temporal gap between consecutive real SLC dates exceeds the limit
1001	real SLC shares a date with its burst's CCSLC reference date
1002	CCSLC reference date later than allowed for the mode
2000	forward mode has no CCSLC, or a burst with real SLCs has none of its own
2001	forward-mode nearest-N network deeper than the real SLC stack

Important

This renumbers the network-depth check from 2002 to 2001, so the codes
form two contiguous blocks. 2002 shipped in v0.5.14; that release is being
re-cut with these fixes, so nothing should be pinned to the old number — but
it is a deliberate breaking change to an already-published code, and worth a
look if anything downstream maps it.

Other changes

• _assert_no_large_temporal_gaps is now scoped per burst and reports every
  offending gap at once rather than only the first. Bursts are processed
  independently, so one burst's coverage shouldn't paper over a genuine hole in
  another's. It also takes a plain file list; the Mapping overload had one
  caller and no test coverage.
• Burst grouping is defensive: opera_utils.group_by_burst raises a bare
  ValueError on filenames it can't parse a burst ID from, which would replace
  a coded precheck failure with an uncoded crash before any check ran. It now
  falls back to a single pooled group, preserving the pre-existing behavior for
  such names. (Real OPERA CSLC/CCSLC names always parse; this is about not
  turning an unexpected name into a confusing failure.)
• _assert_forward_mode_compressed's docstring described a "connected to the
  stack" reference-date-overlap check that was never implemented in the body.
  Replaced with a description of what the function actually does.
• Compressed-SLC reference dates are now logged per burst when they're saved,
  so a forward run's log shows what the next run will consume.
• New runconfig field run_input_prechecks (default true) turns every
  numbered check on or off from the runconfig yaml. It is an operational escape
  hatch for forcing a run whose inputs a precheck rejects; off, a malformed input
  list fails inside dolphin or not at all. A runconfig predating the field loads
  with the prechecks on. 2001 is gated by withholding cslc_file_list from
  _create_forward_mode_network, so the network built is identical either way.
  The uncoded duplicate-date check is deliberately not gated.
• New docs: docs/error-codes.md (every code, its message, cause and fix) and
  docs/disp-s1-operations.md (CCSLC operational logic, mode
  differences, and the filename conventions for both the self-generated
  compressed_* form and the official OPERA_L2_COMPRESSED-CSLC-S1_* form).

Testing

• Full suite: 75 passed, 2 skipped.
• New unit tests for 1001/1002 mode asymmetry, the no-CCSLC no-op, and the
  burst-grouping fallback (including the mixed-parseability case, where pooling
  only one side would silently skip the check).
• New unit tests for run_input_prechecks: the default, a yaml round-trip, a
  runconfig with the key absent (must load with the prechecks on), 2001 raised
  when on and skipped when off, and main.run calling exactly the expected
  checks when on and none when off.
• Scenario suite over the real delivery inputs exercising every code and its
  negative control, including that the same straddling
  stack fails 1002 in historical and passes in forward, and that every check
  fires when just one of the two bursts violates it (with the message naming
  that burst alone) -- 45/45.
• End-to-end: forward and historical both re-run clean against
  delivery_data_official, and their products validate against the golden
  dataset. (That run predates run_input_prechecks; with the flag at its
  default the code path through both modes is unchanged.)