Emit a diagnostic for a misapplied checked size/align intrinsic marker

[MavenRain]

Description

Fixes a compiler panic when the internal CheckedSizeOfIntrinsic (or
CheckedAlignOfIntrinsic) fn_marker is attached to a function whose
signature does not match the intrinsic.

Context

From the reproducer in #4589:

enum BadRet {
    None,
}

#[kanitool::fn_marker = "CheckedSizeOfIntrinsic"]
fn fake_checked_size_of(ptr: *const u8) -> BadRet {
    let _ = ptr;
    BadRet::None
}

#[kani::proof]
fn check() {
    let p = &0u8 as *const u8;
    let _ = fake_checked_size_of(p);
}

Kani panicked during codegen:

thread 'rustc' panicked at kani-compiler/src/kani_middle/transform/kani_intrinsics.rs:
called `Option::unwrap()` on a `None` value
  ...
  kani_compiler::kani_middle::transform::kani_intrinsics::build_some

The checked_size_of / checked_align_of generators assume the marked
function has the signature of the real intrinsic (a raw pointer argument and an
Option<usize> return), and build_some / build_none locate the Some /
None variants by looking for a variant with (or without) a field. The
fn_marker attribute is internal, but nothing stops user code from attaching
it to a function returning some other type; BadRet has no variant with a
field, so build_some unwrapped a None and the compiler panicked.

Change

Validate the marked function's signature before generating the body. When it
is not a raw pointer argument with an Option-shaped return, emit a normal
compiler error instead of panicking. This matches how Kani already reports
other misapplied kani-internal attributes. The valid intrinsic path is
unchanged.

Testing

• Added tests/ui/invalid-intrinsic-marker/, which runs the reproducer and
  checks for the new diagnostic:

  error: the `CheckedSizeOfIntrinsic` intrinsic marker can only be applied to a function with a raw pointer argument that returns `Option<usize>`
  

  Verified it passes via compiletest --suite ui --mode expected.

• Confirmed no regression to the real intrinsic path: the existing
  tests/kani/SizeAndAlignOfDst/unsized_tail.rs still verifies successfully
  (9/9 harnesses).

• cargo check -p kani-compiler passes and the file is rustfmt-clean.

Resolves #4589

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 and MIT licenses.