Classify invalid Kinesis Protobuf inputs as usage errors #1006

Invalid Kinesis Protobuf option combinations are rejected with useful messages, but use generic runtime exit 1 (error.code: other) rather than the CLI's usage-error exit 2. This is a small scripting/error-classification consistency issue; invalid input is already rejected safely.

Observed with installed CLI 0.5.0, main df81e46cfec0bb58ea981d17cc6fd2de24442e7d. The QA probes supplied the other required Kinesis create fields, synthetic management credentials/org/service IDs and loopback URL http://127.0.0.1:9; no AWS source, cloud request or ClickPipe creation was needed.

The second case fails on the incompatible option combination before trying to read the named file. Separately, a genuinely missing file with the correct Protobuf format returns an IO error; that runtime failure is not part of the requested usage-error change.

The Kinesis builder's relationship checks and schema reader currently create generic Cloud errors.

Classify these deterministic input/relationship errors as usage failures, preserving the actionable messages and the distinction from IO, authentication and API failures. Use parse-time constraints where suitable and an explicit usage path for stdin-dependent validation. Add behavior coverage for the three cases and preserve successful file/stdin schema handling; do not pin full help/error prose.

Related closed #853 handled the same exit-code class issue on other commands, but did not cover this Kinesis Protobuf surface. No duplicate issue was found. No release milestone or blocker designation is requested.