fix(serve): validate --device via clap possible values (exit 2)

[r0x0r]

Summary

rocm serve --device bogus previously rejected the invalid value via application
logic (exit code 1, message "unsupported device policy") instead of clap's
possible values validation (exit code 2). Every other enum-style argument in
the CLI — --engine, config set-*, engines install, etc. — uses clap
possible values, which produces exit code 2 and lists the valid choices.

This models --device as a clap ValueEnum (DevicePolicyArg) so invalid input
is rejected consistently and the valid choices are listed in the error.

Changes

• Add DevicePolicyArg (gpu_required, gpu_preferred, cpu_only) and change
  serve --device from Option<String> to Option<DevicePolicyArg>.
• The historical aliases (auto/gpu → gpu_required, cpu → cpu_only) stay
  accepted for backward compatibility but are hidden from the advertised list.
• The intentional cpu_only app-level rejection (exit 1 with a GPU-required
  message) is preserved — only the generic "unsupported device policy" exit-1
  path is replaced by clap's exit-2 usage error.
• Reworked the device possible-values sync test to read clap's structural
  possible values instead of a hand-written doc string, mirroring the existing
  --engine test.

Behavior

Before:

$ rocm serve qwen --device bogus
Error: unsupported device policy: bogus      # exit 1

After:

$ rocm serve qwen --device bogus
error: invalid value 'bogus' for '--device <DEVICE>'
  [possible values: gpu_required, gpu_preferred, cpu_only]   # exit 2

Tests

• serve_rejects_unknown_device_policy_as_usage_error — asserts invalid
  --device is a clap InvalidValue usage error (fails before the fix, passes
  after).
• serve_accepts_device_policy_values_and_aliases — asserts every value and
  legacy alias still parses to the expected variant.
• serve_device_help_lists_match_device_policy_names — reworked to verify clap's
  structural possible values stay in sync with DevicePolicy.

cargo test -p rocm --bin rocm, cargo clippy -p rocm --all-targets -- -D warnings, and cargo fmt all pass. No new e2e scenario is added: the change is
a CLI usage-validation/exit-code correction with no new runtime engine behavior,
and it is fully covered by the argument-parsing unit tests above.