Reject controllerSpec clauses other than controllable/safety with controlled_det
A controlled_det composition drives its determinisation purely from the controllable action set (makeControlledDeterminisation reads goal.getControllableActions() and nothing else). The safety clause is also honoured, since its property is composed into the model beforehand via preProcessSafetyReqs. Every other controllerSpec clause (liveness, assumption, reachability, nonblocking, ...) is silently ignored, so a spec that includes one is misleading.
Adds a guard in CompositionExpression.buildAndSetGoal (fired only when isControlledDet) that aborts via Diagnostics.fatal when the goal carries any clause other than controllable or safety.
Adds ControlledDetGoalTest (rejection + no over-fire) and cleans the silently-ignored clauses out of the existing controlled_det fixtures, keeping controllable/safety.
Full suite green (664 tests; TestLTSCompose 150/150).