fix(iotracing): validate device filter bounds

[pkurunner]

Summary

• reject empty --device values instead of silently disabling the filter
• reject major/minor values outside Linux device-number encoding bounds
• add unit coverage for invalid specs and boundary values

Testing

• gofmt -w cmd/iotracing/cli.go cmd/iotracing/cli_device_test.go
• Not run: GOOS=linux GOARCH=amd64 go test -c ./cmd/iotracing is blocked on a clean upstream snapshot by missing generated internal/toolstream/transport capnp types.