fix(q): harden wire decode and port validation

[belowzeroff]

Summary:

• reject Q decoded bodies with trailing bytes after the first object
• validate client/server ports in the C API and embedded CLI before socket use
• add codec selftests and fix flat q install QHOME detection in the test runner

Tests:

• make lint
• bash -n test/run.sh
• git diff --check
• make test Q_BINARY=/nonexistent

Note: full real-q interop was blocked locally by the q license daemon: could not connect to license daemon.