Unknown --timezone values are silently accepted and fall back to the system timezone #1730

Summary

--timezone (and timezone in a config file) is never validated. parse_tz in ccusage-core/src/date_utils.rs does JiffTimeZone::get(value).ok(), so an unknown name becomes None and every report silently groups rows in the system timezone. A typo like America/New_york or Asia/Tokio can change which date a row lands on, with no error and no warning.

Reproduce

ccusage daily --timezone Not/AZone            # normal report, exit 0
ccusage statusline -z Bad/Zone < input.json   # normal output, exit 0
echo '{"defaults":{"timezone":"Not/AZone"}}' > cfg.json
ccusage daily --config cfg.json               # normal report, exit 0

Reproduced on main d341949 and on the published 20.0.20.

Expected

Invalid value for --timezone 'Not/AZone'. Expected an IANA timezone name such as UTC or America/New_York.
Run 'ccusage --help' for usage.

with exit code 2, whether the value comes from a flag or a config file. local, which the configuration guide recommends for the system timezone, stays accepted.

Notes

ccusage-cli-parser does not depend on ccusage-core (and so not on jiff), so the check fits as a post-parse step in the ccusage binary next to last_window::resolve, which already runs there for the same reason. One check covers flags and config values because both land on the parsed args, and it only inspects the timezone the selected command will use, so a flag can still override a bad config value. I have this implemented with tests and a docs line and will open the PR right after triage.