fix(node): validate the profile on a bootstrap dry run

[tas50]

The defect

resolveClient is the only thing that calls Profile.Validate(), and --dry-run skips it. The server URL is then concatenated unconditionally into the client.rb the script writes:

ServerURL: strings.TrimRight(profile.ServerURL, "/") + "/organizations/" + profile.Org,

With a profile that names no Cinc Server — a Supermarket-only one, say, which is perfectly valid on disk and which cinc config create will happily write — the dry run prints a script pointing nowhere and exits 0:

cat <<'CINC_EOF' | sudo tee '/etc/cinc/client.rb' >/dev/null
chef_server_url '/organizations/'
node_name 'web01.example.test'
client_key '/etc/cinc/client.pem'
CINC_EOF

A dry run exists to show what a real run would do. Printing a script that could never work, and reporting success, is the one thing it must not do — especially since the natural next step is to copy that script and run it by hand.

The fix

Validate the resolved profile before building the command, on both paths. A real run reaches the same check a moment later in resolveClient, so this only changes the dry-run path.

Tests

TestNodeBootstrapDryRunRejectsProfileWithoutServer uses a Supermarket-only profile and asserts the command errors and prints no script. Verified red before the fix by stashing it — on main it emits the /organizations/ script above and returns nil.

go test ./..., go vet ./..., and gofmt -l . are clean.

Note

Same function as the --format ordering fix in the sibling PR. Independent changes, so separate PRs as requested, but whichever lands second will want a trivial rebase.