fix(cli): guard --max-action-delta against invalid explicit values

[Tushar2604]

Summary

An explicit invalid --max-action-delta silently weakened guardrails instead of erroring.

The bug:

• _build_guardrails wraps DeltaLimitApprover(space, max_delta=max_action_delta) in a blanket except ValueError and degrades to a stderr warning for any failure.
• That degrade-per-component design is correct for a derived default an embodiment's space can't support — there was never a working default to lose.
• It is not correct for an explicitly passed, malformed value (negative, zero, non-finite). That is a CLI input error, not an embodiment limitation, but it hit the same blanket handler and got downgraded to a warning.
• Result: the operator asks for a tighter per-step limit, mistypes it, and the run proceeds on real hardware with clamp-only guardrails and exit code 0 — silently, unless they are watching stderr.

Changes

• Validate args.max_action_delta in _check_shared_run_conflicts, which already runs before component resolution in both run and eval-set, and already houses the sibling --disable-guardrails conflict check. A non-finite or non-positive value now exits with a guided SystemExit before anything resolves or energizes.
• No change needed in _build_guardrails or DeltaLimitApprover — argparse's type=float means the CLI value is always a plain float, so the other failure mode in _validate_max_delta (array broadcast) can only be reached via the Python API, not this flag.
• Derived-limit degradation is untouched: an embodiment with no declared bounds and no explicit --max-action-delta still warns and continues, exactly as before. Verified manually and confirmed the existing test_cli_degraded_guardrails_warn_but_run still passes unchanged.
• Added parametrized tests for both run and eval-set (-1, 0, inf, nan).
• Added a CHANGELOG.md entry under Unreleased → Fixed.

Checklist

• pre-commit hooks pass — pre-commit run --all-files shells out to uv, not on PATH here; ran ruff check ., ruff format --check ., mypy, and pytest --cov directly, plus the full suite on a Linux checkout.
• Tests added/updated — 8 new parametrized cases (4 values × run/eval-set).
• Coverage stays at 100% — verified on Linux: 100.00% total, 738 passed.
• ruff check . and ruff format --check . pass
• mypy passes (strict) — full run, 63 source files.
• CHANGELOG.md updated under "Unreleased" — Fixed entry.
• Public API unaffected — _check_shared_run_conflicts is a private CLI function.
• Core stays NumPy-only — no new deps.

Note: I did not run the docs-build job locally (it needs a full Node/npm toolchain for the Docusaurus site). Confirmed by inspection this diff is out of scope for it — no changes to docs/, website/, or any public docstring, and CHANGELOG.md is not referenced by the site build.

Related

Closes #154.

[jeqcho]

Merged, thank you @Tushar2604. Two things stood out. Putting the guard in _check_shared_run_conflicts instead of _build_guardrails was the right architectural read: the catch-and-warn path exists for derived defaults an embodiment can't support, and your fix closes the explicit-input hole without touching that behavior (leaving test_cli_degraded_guardrails_warn_but_run untouched made that easy to confirm). And the parametrized tests covering -1, 0, inf, and nan on both run and eval-set pin the contract exactly where the bug lived.

Good hunting on this one. More where it came from is always welcome.