uttrflow-bakeoff complete --limit with a negative number crashes after the suggestion model has loaded

## What happens

`Sources/uttrflow-bakeoff/Complete.swift:32` declares `--limit` as `Int?` with no `validate()` in the command. `measure(with:)` does `chosen = Array(chosen.prefix(limit))` at line 109. `prefix` with a negative count traps, so `uttrflow-bakeoff complete --fixtures --limit -1` crashes, and it does so only after the model has been loaded for scoring.

This is the same class as #493 and #510 in the same tool, on an option those issues do not cover.

## Why it matters

Loading the suggestion model takes seconds and gigabytes; a mistyped number should be refused before that, with a message, not end in a crash report.

## Acceptance criteria

- `Complete` gets a `validate()` that refuses `--limit` below 1 with a message naming the option.
- Valid values behave as today.

## Where to start

- `Sources/uttrflow-bakeoff/Complete.swift`.
- `validate()` in `Sources/uttrflow-dev/Bench.swift:32` is the pattern to follow.
- There is no test target for `uttrflow-bakeoff`; say in the pull request that `--limit -1` is now refused. That check needs no model, because `validate()` runs before `run()`.
- Read [CONTRIBUTING.md](https://github.com/uttrflow/uttrflow-swift/blob/main/CONTRIBUTING.md) first, and say on this issue that you are taking it.
- Before pushing, run `make verify` (with `DEVELOPER_DIR` pointing at Xcode 26.6 or later). It is the same command CI runs.

**Size:** XS, under 1 hour.

Read CONTRIBUTING.md, then inspect Sources/uttrflow-bakeoff/Complete.swift and compare its validation with validate() in Sources/uttrflow-dev/Bench.swift:32. Verify that --limit -1 is refused before run() loads the model, valid values remain unchanged, and make verify passes with the required Xcode version.

Written by the indexing model from the issue text.