fix(lang): refuse a def call missing a required argument

[haribo]

Summary

• A def calling another instruction with too few arguments was accepted; the missing parameter bound to the empty string. file.write(path) inside a def therefore overwrote the file with nothing and reported ok.done.
• Reproduced on a real target before the fix, and again after:

before:  probe.w(p=/tmp/arity.txt) ok.done      → file emptied
after:   probe.w(p=/tmp/arity.txt) err.agent
             ! file.write takes 2 argument(s), got 1
         → file still holds `the original content`

• internal/lang/eval.go checked only the upper bound. A plan-level call has always been checked on both (parser.go), so the same mistake was refused in a plan and silent in a def — where defs compose and nobody reads the call site.

What the audit established before any code

• The fix invents nothing: requiredCount (parser.go:276) already counts parameters without a default, in the same package. The lower bound is that count, so omitting a defaulted parameter stays legal — which is what defaults are for.
• Nothing in the tree depends on the laxity: all 49 stdlib signatures were read and every def→def call counted against them — 0 under-supplied calls. The four defs with optional parameters (docker.prune, docker.compose-restart, dir.copy, dir.sync) are unaffected.

Test plan

• Three tests, the first written and watched fail: too few refused naming the callee and both counts; too many still refused; a defaulted parameter may still be omitted, asserting the default actually reaches the callee.
• Verified on a real target in both directions, including that the file survives the refusal.
• go test ./..., lint.sh, dead-code.sh, coverage-ratchet.sh, changelog-rule.sh — green.

Out of scope

Why a def-side call and a plan-side call are validated by two separate pieces of code at all. That is worth an issue; it is not this fix.

Closes #633