Reject negative default_retention_days in task SDK and core API routes

[amoghrajesh]

---

Was generative AI tooling used to co-author this PR?

• Yes: claude sonnet 4.6

What?

[state_store] default_retention_days could be set to a negative integer without any error. The task sdk silently treated it as "never expire" (same as 0), and the API route would compute a negative timedelta, producing an expires_at in the past.

Current behaviour

A negative default_retention_days in config is accepted without complaint. In the sdk, days <= 0 mapped to expires_at=None — so -5 behaved identically to 0. In the API route, it produced an expires_at timestamp in the past, causing state rows to expire immediately.

Proposed change

• SDK (context.py): set() raises ValueError with a clear message if default_retention_days < 0. days == 0 (disable expiry) continues to work.
• API (task_state.py): _resolve_expires_at() returns HTTP 400 Bad Request if default_retention_days < 0. days == 0 correctly returns None (never expire).

Note: expires_at="default" with default_retention_days=0 now correctly stores expires_at=NULL (never expires) on the API path. Previously it computed now + timedelta(days=0) = now, causing rows to expire immediately, which contradicts both the sdk behaviour and the config docs ("Set to 0 to disable expiry").

---

• Read the Pull Request Guidelines for more information. Note: commit author/co-author name and email in commits become permanently public when merged.
• For fundamental code changes, an Airflow Improvement Proposal (AIP) is needed.
• When adding dependency, check compliance with the ASF 3rd Party License Policy.
• For significant user-facing changes create newsfragment: {pr_number}.significant.rst, in airflow-core/newsfragments. You can add this file in a follow-up commit after the PR is created so you know the PR number.

[jroachgolf84]

Quick question; are we now able to trigger a cleanup with the API? If so, I need to update my docs.

[amoghrajesh]

Unrelated failures, merging