feat: add Command.ArgValidator for tree-wide argument validation

[dearchap]

What type of PR is this?

• feature

What this PR does / why we need it:

Adds ArgValidator to *cli.Command — an optional hook that runs before Before and Action. It is inherited by subcommands unless they set their own. Returning a non-nil error short-circuits the command and propagates as the exit error.

This is useful for security-boundary CLIs that need to reject shell metacharacters or other patterns before user-supplied bytes reach an exec call, as well as for tracing, metrics, or authz middleware that applies tree-wide.

root := &cli.Command{
    ArgValidator: func(ctx context.Context, cmd *cli.Command) error {
        for _, arg := range cmd.Args().Slice() {
            if containsMetachar(arg) {
                return fmt.Errorf("rejected: %q", arg)
            }
        }
        return nil
    },
}

Which issue(s) this PR fixes:

Closes #2327

Testing

• go test ./... passes
• go vet ./... passes
• 5 new tests cover: runs before action, error short-circuits, inherits from parent, subcommand override, runs before Before hook
• make v3diff shows only the new ArgValidatorFunc type and ArgValidator field
• make v3approve run to update API surface docs

Release Notes

Add Command.ArgValidator for tree-wide argument validation with subcommand inheritance.