Setting dryRun / validate_only to true will result in UNREGISTERED being returned for various scenarios when a token is invalid.
However if dryRun / validate_only is true, there is at least one scenario when FCM will not do the desired validation: if the app associated with the token has reached 270 days of inactivity, the api will not respond with UNREGISTERED.
Is it possible to see if a token is invalid due to the 270d expiration rule without sending a push notification to the device?
I'd suggest reading the documentation, which clearly explains the behavior to be expected:
When stale tokens reach 270 days of inactivity, FCM will consider them expired tokens. Once a token expires, FCM marks it as invalid and rejects sends to it. However, FCM issues a new token for the app instance in the rare case that the device connects again and the app is opened.
Which means, that after 270 days of inactivity, the push message won't be delivered anymore and I really don't understand your fixation on dryRun (which may be lacking one validation check), because it generally has nothing to do with that. Unless the user would actively open the app, while having access to the internet, no new (and also active) token will be issued for the instance of app installation, which may have an expired token, due to previous inactivity.
This is "by design" and trying to work against it is therefore pointless. One could in best case compare to the timestamps from UserMetadata.lastSignInTime, while I'm not certain if the bare FCM token would feature any user ID or timestamp, unless recording them upon creation. By default, one could only identify the users, which signed in > 270 days ago and assume, that their tokens may have expired.
When removing expired tokens, this all is a non-issue, because they'd simply be gone.