fix(make): refuse a swarm-zombie run act would match against nothing

The target pins apps, variant and mode into ACT_MATRIX. When the generated matrix holds no such row, act matches nothing, deploys nothing and exits 0 - a job that reports green while drilling nothing, which is how the mariadb zombie ran since e846063f5.

cli.meta.ci.validate already answers exactly that question for a selection token, down to naming the alternative ('offered: compose', 'declares 2 variant(s)'), so the target asks it before tearing a cluster down rather than reimplementing the check in the recipe.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Makefile

@@ -702,6 +702,7 @@ SWARM_DISTROS = $(or $(distros),$${INFINITO_DISTRO:?})
 # Note: Use `make swarm-exec` / `make swarm-shell` to inspect, `make swarm-down` to release.
 swarm-zombie: install-act
 	@test -n '$(app)' || { echo 'usage: make swarm-zombie app=<application_id> [distros=<distro>] [variant=<idx>] [name=<cluster-id>] [disable=<keys>]'; exit 2; }
+	@"$${PYTHON}" -m cli.meta.ci.validate --whitelist '$(app)#$(or $(variant),0)@swarm'
 	@SWARM_NAME='$(or $(name),$(app))' INFINITO_KEEP_SWARM_NODES=false bash scripts/tests/deploy/swarm/utils/clean/teardown.sh
 	@bash scripts/tests/deploy/act/down_act_outer.sh
 	@ACT_RM=false \