Check script/loadtest's duration before the build

A duration must be a whole number above zero followed by ms, s, m or
h; anything else prints the usage line and exits 2 before the image
build, as a bad number of clients already did. vegeta takes 0 to mean
no end. The load test's entry moves to the top of Completed Steps in
TODO.md.

Model: opus-5-5

TODO.md

@@ -31,15 +31,6 @@ P2: security: per-IP rate limiting on the image routes
 
 # Completed Steps
 
-- 2026-10-04 `cmd/pixad/main.go` is one call into `internal/` (closes #206):
-  what it did (the command line and its `--config` flag, setting
-  `PIXA_CONFIG_PATH`, ignoring `SIGPIPE`, starting the fx app) is now `Run` in
-  `internal/app`, unchanged, and `main` calls it with `Version`, which the build
-  still sets through `-X main.Version`. That code had no tests to move.
-- 2026-10-04 `.gitignore` ignores `.claude/` (closes #204): the entry and its
-  comment are copied from the canonical `.gitignore` in `sneak/prompts`,
-  unanchored so it matches at every depth. `.dockerignore` already has
-  `.claude`.
 - 2026-10-04 load test (closes #81): `script/loadtest [duration [clients]]`
   (`make loadtest`, defaults `10s` and `4`), a benchmark that `script/check`
   does not run, measures three scenarios, each against a new pixad container and
@@ -55,6 +46,15 @@ P2: security: per-IP rate limiting on the image routes
   not pixad's limit); `miss` 70 r/s, p50 52 ms, p95 91 ms, p99 122 ms, peak 100
   MiB, one fetch per request; `herd` 74 r/s, p50 52 ms, p95 69 ms, p99 111 ms,
   peak 60 MiB, 188 fetches for 749 requests.
+- 2026-10-04 `cmd/pixad/main.go` is one call into `internal/` (closes #206):
+  what it did (the command line and its `--config` flag, setting
+  `PIXA_CONFIG_PATH`, ignoring `SIGPIPE`, starting the fx app) is now `Run` in
+  `internal/app`, unchanged, and `main` calls it with `Version`, which the build
+  still sets through `-X main.Version`. That code had no tests to move.
+- 2026-10-04 `.gitignore` ignores `.claude/` (closes #204): the entry and its
+  comment are copied from the canonical `.gitignore` in `sneak/prompts`,
+  unanchored so it matches at every depth. `.dockerignore` already has
+  `.claude`.
 - 2026-10-04 `.dockerignore` keeps secrets out at every depth (closes #205): the
   file is now the standard one from `sneak/prompts`, whose patterns match in
   every directory and, for environment files and private keys, in any letter

script/loadtest

@@ -32,14 +32,27 @@ VEGETA_COMMIT=4b240c3089fa4aa10816542d64a74294d974211f
 # routed on the internet.
 SUBNET=203.0.113.0/24
 
+usage() {
+    echo "usage: script/loadtest [duration [clients]]" >&2
+    exit 2
+}
+
 main() {
     duration="${1:-10s}"
     clients="${2:-4}"
+    # The duration is a whole number, not zero (vegeta takes 0 to mean no
+    # end), followed by ms, s, m or h.
+    case "$duration" in
+        *ms) number="${duration%ms}" ;;
+        *s | *m | *h) number="${duration%?}" ;;
+        *) usage ;;
+    esac
+    case "$number" in
+        "" | *[!0-9]*) usage ;;
+    esac
+    [ "$number" -gt 0 ] || usage
     case "$clients" in
-        *[!0-9]* | 0)
+        *[!0-9]* | 0) usage ;;
-            echo "usage: script/loadtest [duration [clients]]" >&2
-            exit 2
-            ;;
     esac
 
     cd "$ROOT"