Refuse linCmtB(which1 = -3) when linCmt() compartments lag differently

[mattfidler]

Summary

Fixes #1237.

linCmtB(which1 = -3) (the dose-time / moving-boundary sensitivity added in #1235) is the derivative of a linCmt() model wrt ONE delay applied to every dose feeding the linear system -- valid only when every dosed linCmt() compartment shares the same alag(). A model that lags two linCmt() compartments differently (e.g. alag(depot) and alag(central) driven by distinct parameters) previously built and solved silently to the wrong, single-delay answer instead of erroring.

The full architectural fix -- per-compartment sensitivity vectors carried through the linCmt solve (extending numLinSens, the linCmtFlg/.rxLinCmt()/op->linOffset plumbing, saveJac/restoreJac) -- is a much larger change explicitly shared with #1236 and is not attempted here. Instead this implements the "meanwhile" guard the issue itself scoped out: refuse to build the offending model instead of silently returning a wrong answer.

• rxode2() now detects, at build time, when a model calls linCmtB() with a (possibly indirect, via simple constant folding) literal which1 = -3 while its linCmt() compartments carry more than one distinct alag() expression, and raises a clear error instead of compiling.
• A single compartment's alag() assigned conditionally (different text per if/else branch) does not by itself trip the guard -- only a mismatch across compartments does.
• Updated the linCmtB header comment in src/linCmt.cpp to point at the new guard.

This underwent an independent review pass (Antigravity/Gemini) that surfaced two real gaps, both fixed and covered by new tests: a which1 value reached indirectly through a constant variable, and a false positive on a single compartment's conditionally-reassigned alag().

Test plan

• New test file tests/testthat/test-lincmt-dose-time-sens-guard.R (7 tests): errors on distinct alag() across two linCmt() compartments, allows a shared alag(), allows distinct alag()s when which1 = -3 is never used, allows a single lagged compartment, allows no modeled alag() at all, still errors when which1 is reached indirectly through a constant, and allows a single compartment's conditionally-reassigned alag().
• Existing tests/testthat/test-lincmt-dose-time-sens.R (20 tests, unmodified) still pass.
• Full lincmt/event-sensitivities/prior-density filtered suite (6730 tests) passes after merging latest main.
• Full repository test suite (~39k tests) passes (aside from an unrelated, intentionally-failing demo test).