fix(cli): validate refs type before loading table

[jx2lee]

Summary

• Reject invalid refs --type values before loading table metadata
• Allow only branch, tag, or an omitted type filter.

Testing

• go test ./cmd/iceberg -run TestRunRefsRejectsInvalidTypeBeforeLoad -v
• go test ./cmd/iceberg

[zeroshade]

Clean pre-flight validation — constants not literals, the output.Error path so --output json is respected, and the load-tracking assertion proving metadata is never fetched for an invalid type is exactly the right test shape. Thanks!

---

This review was drafted with an AI-assisted tool and may contain mistakes; an Apache Iceberg Go maintainer has reviewed and confirmed the submission. See the contributing docs for what the project considers a maintainer review.