test: cover client demo regression invariants

[cursor]

Summary

• Add a deterministic source-guard regression test for the extracted client demo module.
• Register the test in CTest and document it in the tests README.

Risky behavior now covered

• Demo record/stop-record filename handling, temp-file rename ordering, explicit overwrite vs implicit collision suffixes, and recording state cleanup.
• Demo playback parsing guards for short headers, EOF sentinels, oversized payloads, truncation before CL_ParseServerMessage, pure-server bypass/restore ordering, protocol fallback, and playback state setup before priming.
• cl_main.c delegation to cl_demo.c plus demo command add/remove lifecycle.

Test files added/updated

• Added tests/scripts/test_client_demo_regressions.sh.
• Updated CMakeLists.txt with test_client_demo_regressions.
• Updated tests/README.md validation list.

Why this reduces regression risk

The recent demo-module extraction moved core record/playback behavior into a new file without a runtime-friendly test path in headless CI. These guards cover parser bounds checks, file probing, and command lifecycle invariants that can break demo playback/recording or allow malformed demo data to reach the parser.

Validation

• tests/scripts/test_client_demo_regressions.sh
• cmake -S . -B build-coverage-tests -DBUILD_TESTING=ON -DBUILD_UNIT_TESTS=OFF && ctest --test-dir build-coverage-tests -R test_client_demo_regressions --output-on-failure