[jadenfix]

Reject unknown --at-least-one-of requirements before invoking Cargo, while retaining per-package filtering and the explicit --ignore-unknown-features escape hatch. Check all selected packages together so a feature unique to one workspace member remains valid, including dependency feature references.

Fixes #259.

Validation:

• The reproducer succeeds incorrectly on the baseline and now fails before running any Cargo checks.
• RUSTFLAGS="-D warnings" cargo test --all-targets -- --test-threads=2 --skip version_range --skip rust_version --skip multi_target: 19 unit and 62 integration tests pass. Four tests that install additional toolchains were excluded to bound local disk usage.
• RUSTFLAGS="-D warnings" cargo clippy --all-targets -- -D warnings and cargo +nightly fmt -- --check pass.
• Integration tests execute the actual CLI and Cargo on single-package and multi-package fixtures, covering selection, exclusions, mixed/all unknown features with the escape hatch, and dependency feature references.

Prepared with Codex assistance and independently reviewed by a separate Codex agent. No human review is claimed.