[Hackathon] guard test list status validation before auth

[Lexiie]

Discord Username / User ID

lexiisme

What does this improvement do?

testsprite test list --status <invalid> should always fail as local input validation before credentials, network, or filesystem work.

Current upstream/main already validates the status filter before constructing the client, but there was no focused regression test pinning that order. Without coverage, a future refactor could accidentally move status validation after client creation again, causing machines without configured credentials to see AUTH_REQUIRED instead of the expected VALIDATION_ERROR for bad user input.

Details / implementation notes

Expected behavior:

• test list --project project_alice --status junk should reject locally with VALIDATION_ERROR.
• The command should not read credentials or construct the HTTP client before rejecting the invalid status token.
• This keeps status-filter validation aligned with the existing local validation behavior for missing --project, invalid --type, invalid --created-from, and invalid pagination flags.

Proposed fix:

• Add a focused runList command-parser regression test with no injected credentials.
• Assert invalid --status rejects with VALIDATION_ERROR so validation order remains protected.
• No runtime code change is needed on current main; this is a coverage guard for an already-correct implementation order.

Confirmations

• I have searched existing issues and this is not a duplicate.
• I have provided my Discord identity above for reward coordination.