fix(node): validate --format before bootstrap does any work

[tas50]

The defect

node bootstrap resolved --format after the SSH run. Every other command in the tree resolves it first, before touching anything.

So a typo costs the user a real bootstrap. With --format yaml, the command generates a client key, creates the client on the server, connects over SSH, runs the installer, and only then fails:

error = printer: unknown output format "yaml" (want human or json)
client created on server = true; ssh runs = 1

The user is left with an orphaned client on the server and a half-configured host, plus a non-zero exit that mentions neither. bootstrap is the single most side-effecting command in the CLI, which makes it the worst place to validate flags late.

The fix

Resolve the format at the top of RunE. Nothing else moves.

Tests

TestNodeBootstrapRejectsBadFormatBeforeDoingWork drives the real command with a bad --format and asserts no client was created and no SSH ran. Verified red before the fix by stashing it:

--- FAIL: TestNodeBootstrapRejectsBadFormatBeforeDoingWork
    a client was created on the server before --format was validated
    bootstrap ran over SSH before --format was validated: [...]

go test ./..., go vet ./..., and gofmt -l . are clean.

Note

This touches the same function as the --dry-run profile-validation fix in the sibling PR. They are independent changes so they are separate PRs as requested, but whichever lands second will want a trivial rebase.