[tnalbant]

What and why

ratelimit set validated nothing:

• --mode was cast straight to client.LayerMode, so --mode nonsense was accepted and stored. The failure surfaced later, wherever the stored mode was interpreted.
• --minute, --hour and --day accepted zero and negative values, which downstream throttling does not expect.

Both are usage errors now, and they are raised before the GetSecurityLayers round trip, so a typo never reaches the server.

• --mode accepts off, detect and block. redact is deliberately not accepted: it belongs to the DLP layer, and the existing usage line already says --mode off|detect|block.
• Each limit that is passed must be positive; the message names the flag and the value that was rejected.

Fixes #135

How I checked it

New tests, run against the unpatched code:

$ go test ./security/ -run "TestParseRateLimitMode|TestRunRateLimitSet"
security/ratelimit_test.go:62:15: undefined: parseRateLimitMode
FAIL	github.com/solongate/agent-security/packages/cli/security [build failed]

With the change:

$ go test ./security/ -run "TestParseRateLimitMode|TestRunRateLimitSet" -v
--- PASS: TestParseRateLimitMode (0.00s)            # off, detect, block accepted; redact, nonsense, BLOCK rejected
--- PASS: TestRunRateLimitSetRejectsUnknownMode     # exit 1, message lists off|detect|block, stored mode unchanged
--- PASS: TestRunRateLimitSetRejectsNonPositiveLimits # minute/hour/day x 0/-1, all exit 1
--- PASS: TestRunRateLimitSetAppliesValidValues      # --mode block --minute 30 still stores block/30
--- PASS: TestRunRateLimitSet                        # the five existing subtests still pass
ok  	github.com/solongate/agent-security/packages/cli/security	0.358s

The tests drive the real command handler with client.New(), and the rejection tests assert that the stored layers are unchanged afterwards, so a future refactor that moves validation after the write would fail them.

$ go test ./...      # packages/cli: the security package passes
$ go vet ./...       # exit 0
$ gofmt -l security/ # empty

go test ./... in packages/cli still reports TestProtectAdd and TestProtectList in packages/cli/policy on this macOS host: the immutable-flag tests fail in TempDir cleanup with operation not permitted. That package is untouched by this diff, and the failure reproduces on main.