fix(cli): reject non-positive list limits

[YIKUAIBANZI]

Summary

• reject non-positive sessions list and cron runs limits before opening a gateway connection
• emit the standard INVALID_REQUEST JSON envelope and exit code 2 for invalid CLI input
• reject non-positive operator sessions.list RPC limits while preserving the published guest-limit clamp behavior
• add regression coverage for both CLI commands and the legacy sessions RPC adapter

Fixes #1558

Verification

• uv run ruff check src tests
• 99 focused CLI/gateway tests passed
• full suite: 25,349 passed, 259 skipped; four host-tooling failures on macOS were re-run successfully with the Linux CI prerequisites (docker command behavior and GNU sed)
• npm --prefix opensquilla-webui run build
• uv build --wheel

Third-party origins

none