fix(cli): reject --index 0 and validate braced substitution variable names

[Jaro-c]

Summary

Two correctness fixes for invalid CLI/compose input that was previously
accepted silently.

1. --index 0 rejected as out of range (replica_name_at)

The 1-based --index flag (used by exec, cp, commit, export)
mapped index 0 to replica index 0 via (i as usize).saturating_sub(1),
silently returning the first replica instead of rejecting the invalid
1-based index. It now uses checked_sub(1) and errors on 0 with a clear
"indexes are 1-based" message.

2. Braced substitution variable names validated (parse_braced_var)

${...} name collection accumulated any character that was not a
}/:/-/+/? delimiter, so ${FOO BAR} and ${FOO.BAR} produced a
lookup key containing spaces/dots. The name is now collected with
is_var_char — matching the unbraced $VAR path and the compose-spec
grammar — and any trailing junk before a modifier delimiter is rejected via
a new InvalidSubstitution error. Valid forms (${FOO}, ${FOO:-default},
including defaults that contain spaces/dots) are unaffected.

Tests

• replica_name_at: index 0 → error, index 1 → first replica, index N →
  Nth replica, out-of-range → error, None → first replica.
• parse_braced_var: ${FOO BAR} → error, ${FOO.BAR} → error, ${FOO}
  and ${FOO:-default} → valid.

cargo fmt, clippy -D warnings, build --all-features, and
test --lib --all-features (660 passing) all green. Public API and
behaviour for valid input are unchanged.

Closes #483