fn parse_rfc3339(value: &str) -> Result<DateTime, String>
Validate an RFC3339 timestamp at parse time so a bad value is a clap error rather than a cryptic backend scalar rejection.