refactor(pass)!: return errors from run options

[Benehiko]

RunCommand currently accepts invalid options during construction: an empty socket path silently selects the Desktop default, and negative timeout errors surface only when the command executes.

Make RunOption return an error and have RunCommand return the first option error before creating a command. Reject empty socket paths and negative request/response timeouts. Zero timeouts remain valid, and omitting WithSocketPath uses the Desktop default.

BREAKING CHANGE: RunCommand now returns (*cobra.Command, error), and RunOption now has signature func(*runOpts) error. Callers must handle the constructor error before using the command. Replace WithSocketPath("") with omission of the option when the default is intended.

Validation:

• go test -race ./plugins/pass/commands
• Linux and Windows cross compilation of ./plugins/pass/...
• Constructor tests cover invalid options, zero timeouts, defaults, and stopping at the first option error; existing subprocess tests cover command execution.
• git diff --check

[docker-agent]

Assessment: 🟢 APPROVE

[docker-agent]

Assessment: 🟢 APPROVE

[docker-agent]

This review covers only the commits pushed since 6eae107.

Assessment: 🟢 APPROVE

The incremental diff contains only documentation comment changes to plugins/pass/commands/run.go:

• Removal of the now-redundant godoc line // RunOption configures a run command and reports invalid option values. above the RunOption type (the type signature itself is self-documenting after the earlier refactor).
• Simplification of the RunCommand godoc from two lines to one: // RunCommand uses [api.DesktopSocketPath] by default.

No logic, behaviour, exported API, or test code was changed in this incremental push. No bugs introduced.