ls: ensure_compliant_schema should validate, not trust, and return a more helpful error message

[asmacdo]

When con-duct ls reads an info.json that's missing a required field, the failure is opaque. This doesn't happen in the wild AFAIK, but we shouldn't rely on the handling of "whenever any field is used".

/home/austin/devel/duct/.worktrees/add-uname-to-info-json/info.json

{
  "schema_version": "0.2.2"
}

con-duct ls info.json
[WARNING] con_duct.ls: Failed to load file <_io.TextIOWrapper name='info.json' mode='r' encoding='UTF-8'>: 'system'

Two things to improve (both in src/con_duct/ls.py):

1. Message quality. Should return the path not the io.TextIOWrapper …> noise
2. Should surface missing keys cleanly, ie Failed to load path/to/info.json: missing required field 'system'.
3. Real validation. ensure_compliant_schema only trusts the claimed schema_version and runs migrations; it never verifies the record actually conforms. It should validate required fields so incomplete records fail the same clean way regardless of claimed version.

Context: split out of the review discussion on #425.