feat(authoring): compose private release CLI roots

[777genius]

The private release build mode connects both CLI entrypoints to the shared standard-first engine. Root/help/version/author routes avoid installer setup; retired plugin-kit commands reject before effects while preserving their implementation and default v1 behavior. Stacked on #168; no public release activation.

Corrections preserve installer aliases and diagnostics, protect completion diagnostics, handle legal boolean spellings, enforce exact inventory coverage and preserve Cobra's empty-name completion fallback. Independent review findings have been addressed; the final bounded 31-line correction was inspected and verified with the unchanged reviewer oracle.

Runtime validation at fbc9dcda9307328805c945caac21f31bef7688f6 (runtime source unchanged by the following test-only correction):

• Independent differential oracle: 11,016 cases, zero discrepancies, all 5,275 actual Cobra errors rejected. Focused containment/routing/compatibility and native fixture probes pass.
• Root controlled build and independent identity verification passed for both Linux executables. Exact-commit native E2E passed with zero skips, covering all five templates, shared report/tree parity and identity negatives.
• Root separately verified 16 actual-native completion and containment cases from this exact candidate.
• Candidate manifest SHA-256: 23fe0ccebd33897fc4d1df26dde76b50faf473c7a9ba38242435e30aa6f59b93.
• All eight CI checks passed for this exact head: native Linux/Windows amd64/arm64 and both polyglot/source-acquisition matrices. CodeRabbit skipped this unsupported base branch and is not counted as review evidence.

Limits: native CI's historical vertical-slice mode is distinct from the root-controlled release-cli-contract-v1 proof. Existing Windows concurrency and macOS writable-source gates remain unresolved. Packed npm wrappers, public docs/exporter/metadata and release activation remain later gates. Release eligibility, platform acceptance and attestation remain false. Useful legacy source, dependencies and tests remain preserved.

Current head 692cae54b7ba8ea43ed9500087bf98caf0dd92c7 scopes the Git-dependent release producer fixture to repository runs, matching its sibling tests. All 14 repository marker cases pass with zero skips on Node 22 and 24. The full detached stage-release suite passes on both runtimes with its disposable loopback fixtures permitted; original assertions and packed payload checks remain intact. All eight current-head CI checks also pass: native Linux/Windows amd64/arm64 (run 34054195267), plus Linux/Windows polyglot and source-acquisition checks (run 34054195284). The native evidence above remains explicitly tied to the earlier runtime-identical commit.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Team

Run ID: 3964b693-425e-4f5d-b757-72aceb70f3ef

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}