fix(cli): reject invalid moderation report statuses

[justadityaraj]

Summary

Reject unknown values for buzz moderation reports --status before a request is made.

Related issue

Fixes #7009.

No duplicate pull request was open when this PR was created.

Problem

A typo such as --status opne was forwarded to the relay and looked like a successful empty moderation queue, which can hide open reports from moderators and agents.

Fix

Use clap's existing allow-list pattern to accept only open, resolved, dismissed, or escalated. The parser regression verifies that a supported value parses and a typo is rejected before dispatch.

User impact

Invalid report-status filters now produce a CLI usage error instead of an indistinguishable empty result. Valid commands and request behavior are unchanged.

Verification

• cargo fmt --all -- --check — passed.
• git diff --check — passed.
• cargo test -p buzz-cli moderation_reports_rejects_unknown_status --lib and cargo check -p buzz-cli — could not link locally because this Windows host lacks MSVC link.exe; GitHub CI will run the test matrix.

[github-actions]

🔐 Codex Security Review

Status: review required for the current range.

The current range is 2c99ee7af5a20d239e95ec5368407887449795c9...eacfac11aa544858d4636096fee2a68cdb2d4693.
A new review must complete for this exact range. When manual authorization
is required, a Block organization member must comment exactly
@buzz-security-review eacfac11aa544858d4636096fee2a68cdb2d4693 to authorize a new review.
Any previous review applies only to its recorded range.