bug(fxconfig/cli): --submit and --wait flags silently ignored without --endorse

## Description
In the `fxconfig namespace create` and `update` commands, the `--submit` flag documentation states that it "requires --endorse". However, this constraint is currently never enforced in the code.

If a user runs a command like:
`fxconfig namespace create foo --policy="..." --submit`

They would naturally expect the transaction to be submitted to the ordering service. Instead, because `app/deploy.go` checks if `Endorse` is false and returns early (ignoring `Submit` and `Wait`), the command silently saves an unsigned transaction and completes with no error.

Additionally, using `--endorse` without `--submit` successfully creates and endorses the transaction but does not submit it. While this is valid behavior, it leaves the user without any guidance about the next steps (e.g., that they need to submit it later).

## Steps to Reproduce
1. Run `fxconfig namespace create test --policy="OR('Org1MSP.member')" --submit`.
2. Notice that the command succeeds, but the transaction is not submitted to the ordering service.

## Expected Behavior
- The CLI should enforce flag dependencies and immediately throw an error if `--submit` is used without `--endorse`, or if `--wait` is used without `--submit`.
- When using `--endorse` alone, the CLI should output a helpful message informing the user that the transaction was endorsed but still needs to be submitted.

## Proposed Solution
1. Add a validation method for the CLI lifecycle flags (`--endorse`, `--submit`, `--wait`) and call it from the `RunE` functions in the CLI commands.
2. Update the CLI `--help` documentation to clarify these flag dependencies.
3. Print a helpful message when `--endorse` is used without `--submit`.
4. Add unit tests for the flag validation to prevent regressions.