[P3] fix(cli): Validate --last on log, tune, and policy-history

[github-actions]

Users who pass a negative --last to log, tune, or policy-history see an empty result with no error, and tune -n does not work at all.

Problem

Four CLI commands take --last, but only tui validates it (min=1, src/doberman/cli/main.py:2461). The options on log (:2360), tune (:2221), and policy-history (:2923) have no lower bound. In log, the value goes through max(0, last) and then LIMIT 0, so doberman log -n -3 prints "(no decisions recorded yet)" even when the log has decisions. Also, tune has no -n short form, so tune -n 5 fails with "No such option". Issue #716 reports all of this.

Impact

This is a small CLI consistency bug. The engine is not affected, so there is no security or data risk. The empty-log message can make a user think Doberman recorded nothing, which is a bad signal to get from a security tool. The CLI sends no analytics, so I can't count affected users.

Solution

Add "-n" to the --last option on tune. Add min=0 to --last on all three commands, so a negative value exits with code 2 and Typer's usage error. Keep 0 valid, because it means zero rows (#430, commit 649d491). Add a parametrized test that checks --last -1 exits 2 for each command, and a test that tune -n 5 runs. Add a changelog.d fragment. None of the open PRs (#725, #724, #701, #653) touches these options.

Expected impact

There is no usage data for this CLI, so I can't estimate a credible change in any metric. The expected result: a negative --last fails with a clear usage error on all three commands instead of showing a misleading empty result.

• Actionability: immediately_actionable
• Inbox status: ready
• Signals behind it: 1

Open the report in PostHog

Filed automatically from the PostHog Self-driving inbox. It mirrors the finding; the fix is a maintainer's call.