fix: reject a nonpositive -sample instead of widening the scan

[v14d4n]

Fixes #8.

expandV4 treats a sample of <= 0 as "the whole subnet" the sentinel -full sets, so scan -n -1 quietly scanned all 256 addresses of every pool instead of failing.

What changed

-sample is now bounded at 1 by the flag's own parser (flag.Func), so a nonpositive value is a usage error: exit status 2 and invalid value "-1" for flag -n: must be at least 1, the way -n abc already failed.

This covers both commands that register the flag and every spelling of it. -full and the sentinel behind it are untouched, and -sample 300 still scans all 256 addresses: expandV4 clamps, and asking for 300 of 256 can only mean all of them.

intFlagValidate is not specific to -sample; any int flag with a bound can move onto it.

One behaviour difference

The bound applies per occurrence rather than to the final value: -n 5 -n 0 is now rejected, which is the point, and -n 0 -n 5 is rejected too, which is new.

No test

None of the flag validations in the tree are tested, and a test here would mostly assert that flag calls Set. Verified by hand on both commands, including the -target 1.2.3.0/29 repro from the issue.

[vernette]

Thank you!