fix(cli): reject negative values for --parallel flags (#5484)

The --parallel flag was declared with kingpin .IntVar on 12 commands,
which accepted negative values and led to a panic at runtime (e.g.
`snapshot migrate --parallel=-1`).

Declare the --parallel family as uint so kingpin rejects negative input
at parse time.
The uint->int conversion the callee APIs need is done through a small
helper .

Add CLI test that asserts the rejection message (a bare failure check passed
even without the fix since the commands also fail with no repository connected).
Parse via ParseFloat like kingpin's built-in int flag so the only behavior
change is rejecting negatives.

cli/command_cache_sync.go

@@ -12,12 +12,12 @@
 )
 
 type commandCacheSync struct {
-	parallel int
+	parallel uint
 }
 
 func (c *commandCacheSync) setup(svc appServices, parent commandParent) {
 	cmd := parent.Command("sync", "Synchronizes the metadata cache with blobs in storage")
-	cmd.Flag("parallel", "Fetch parallelism").Default("16").IntVar(&c.parallel)
+	cmd.Flag("parallel", "Fetch parallelism").Default("16").UintVar(&c.parallel)
 	cmd.Action(svc.directRepositoryWriteAction(c.run))
 }