fix: validate task args before VM IP resolution

Move the tasks-type guard above resolve_vm_ip() call so that
input validation happens before any real work. Fixes CI failure
where resolve_vm_ip raises RuntimeError in environments without
Azure access.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: abrichr