bug: apply the same validation to CLI overrides and configuration files

[codeforester]

Problem

The demo teaches validated consumer settings, but equivalent input paths disagree: configuration rejects a whitespace release_version while --version accepts it; an invalid UTF-8 config file becomes an internal error instead of the documented configuration usage error.

Verified evidence

Reviewed on 2026-09-12 at 2de6b83f21ccacae04f8050f5691d0dd8159fda1; the local checkout matches GitHub main.

northstar --quiet release plan --version ' '
# exit 0, target_version is a whitespace string and action is update

Write a config file containing byte 0xff and select it with --config: exit 1 and Unexpected internal error. _load_json() catches OSError and JSONDecodeError but not UnicodeDecodeError. The documentation promises safe configuration errors with exit 2.

Sources:

• src/base_cli_demo/cli.py
• src/base_cli_demo/profile.py
• docs/configuration.md

Acceptance criteria

• Use the same non-empty normalization/validation policy for plan/reconcile overrides and configured release_version.
• Translate invalid config encoding into a clear ConfigurationError with exit 2.
• Exercise human and JSON error forms and verify invalid inputs do not mutate local reconciliation state.
• Keep the existing permissive version-string policy; do not introduce a new SemVer requirement without a product decision.

Project fields

• Status: Backlog
• Priority: P2
• Area: CLI
• Initiative: Base-CLI Demo
• Size: S
• Assignee: @codeforester
• Milestone: v0.1.0
• Target date: unscheduled