Reject unknown run config fields

[stacknil]

Summary

• reject unknown top-level, time, feature, and rule config fields before running the pipeline
• keep rule unknown-field validation on the same helper path
• add CLI and config-validation coverage for typo-like fields
• document strict run config validation in README

Validation

• pytest tests/test_run_config_validation.py tests/test_cli_errors.py tests/test_pipeline_e2e.py --basetemp .pytest-artifacts-strict-config-2
• pytest --basetemp .pytest-artifacts-full-strict-config
• python -m telemetry_window_demo.cli run --config configs/default.yaml
• git diff --cached --check
• staged diff privacy/secret keyword scan