feat: require --description when using --apply

A correction created with --apply must now carry a non-blank description;
dry-run previews stay lenient. The help text notes the requirement and a
test covers the abort path.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: Yhoorneman

src/datadog_slo_overrides_cli/datadog_slo_overrides_cli.py

@@ -692,6 +692,8 @@ def build_config(
 
     correction = None
     if apply:
+        if not description.strip():
+            sys.exit('error: --description is required with --apply')
         if start_epoch is None:
             sys.exit('error: --start is required with --apply')
         if end_epoch is None and not rrule:
@@ -849,7 +851,7 @@ def run(
         None,
         help=f'Correction category (config/default: {DEFAULT_CATEGORY}).',
     ),
-    description: str = typer.Option('', help='Free-text description stored on the correction.'),
+    description: str = typer.Option('', help='Free-text description stored on the correction. Required with --apply.'),
     timezone: str = typer.Option(
         None,
         help=f'IANA timezone for start/end (config/default: {DEFAULT_TIMEZONE}).',

tests/test_datadog_slo_overrides_cli.py

@@ -170,6 +170,26 @@ def test_build_config_dry_run_has_no_correction() -> None:
     assert cfg.required_tags == ['app:gitlab']
 
 
+def test_build_config_requires_description_with_apply() -> None:
+    """Applying without a (non-blank) description aborts, even with a valid window."""
+    with pytest.raises(SystemExit):
+        build_config(
+            api_key='key',
+            app_key='app',
+            site='datadoghq.eu',
+            timezone='UTC',
+            category='Scheduled Maintenance',
+            strategy=SKIP_IF_COVERED,
+            description='   ',
+            tags=['app:gitlab'],
+            tags_query=None,
+            start='2026-06-10T22:00',
+            end='2026-06-10T23:00',
+            rrule=None,
+            apply=True,
+        )
+
+
 def test_load_config_ignores_credentials(tmp_path: Path) -> None:
     """Only non-secret keys are honoured; credential-like keys are dropped."""
     config = tmp_path / 'config.toml'