Add optional CLI validation of original ACH control totals

[ryanduguid]

Summary

Add achcli -validate-totals file.ach [other.ach ...] to check the control totals stored in original raw ACH files before submission. The current description command accepts incorrect file counts, hashes and amounts with exit status 0; this optional command returns 1 if any input fails and reports each failing path.

-validate-totals
  -> readACHFile (original records, configured reader checks)
  -> File.ValidateTotals (existing file and batch checks)
  -> exit 0 only if every file passes

The command leaves input bytes unchanged and creates no output files. It rejects JSON because JSON parsing recalculates totals, validation options that waive count checks, and conflicting transformation or presentation flags. Existing commands retain their behaviour. Related to #1428; this proposes an optional CLI command rather than changing default validation.

Evidence

• Before: the unchanged CLI returned 0 without warnings for five public synthetic files with independently corrupted BatchCount, EntryAddendaCount, EntryHash, debit total or credit total.
  After: all five return 1 with the file path and mismatched field. All 69 executable CLI regression cases pass, covering multiple inputs, reader failures and options, missing controls, stored zero totals, nested batch totals, JSON rejection, LF, CRLF and EOF without a final newline, ADV, mixed PPD/IAT files, flag conflicts, help, syntax errors and input preservation. The five default-command controls still pass.
• Native Windows go test ./... passes. Linux make check passes, including the wasm build, lint, gitleaks and shuffled package tests. Project statement coverage is 93.9%, above the required 85%. Checks used Go 1.27.1; the unchanged baseline also passes both full checks.
• A separate native Linux govulncheck -test ./... run passes with scanner v1.8.0 and reports no vulnerabilities found. The initial make check run skipped this optional checker, so its aggregate success alone does not establish a vulnerability-scan result.

Merge danger

Door: two-way. Blast radius: CLI.

The new mode reuses readACHFile and File.ValidateTotals; it adds no library API or dependency. It is limited to the checks those functions provide, including no recalculation of block counts or verification of padding consistency.

Unverified

The Go 1.26 and native macOS CI variants, Docker integration, OpenAPI and web UI jobs have not run locally. Upstream CI is not yet verified. These parts are unchanged.

[adamdecaf]

Thanks!