fix(cli): validate branch and tag retention inputs

[fallintoplace]

Why

The branch/tag create commands previously accepted invalid ref names and non-positive retention values. Those inputs could create metadata updates that should have been rejected up front.

What Changed

• Reject invalid branch/tag names before updates are built, preventing malformed refs (empty names, whitespace-wrapped names, path separators, ./.., control characters).
• Reject non-positive retention settings (--max-ref-age, --max-snapshot-age, --min-snapshots-to-keep) so invalid policies are not persisted.
• Add regression coverage for both branch and tag validation paths.

Testing

go test ./cmd/iceberg -run 'TestRunBranchCreateRejectsNegativeRetentionValues|TestRunBranchCreateRejectsInvalidRefName|TestRunTagCreateRejectsNegativeMaxRefAge|TestRunTagCreateRejectsInvalidRefName' -count=1