fix(cli): reject unknown service selections

[cristim]

--services=rds,elasticahe previously warned about the typo and continued processing RDS. It now fails before execution with the unknown value and a sorted list of accepted names. Explicit empty selections also fail, including alongside --all-services or --input-csv. Existing case folding, aliases, Savings Plans expansion, deduplication, ordering and omitted-service defaults are preserved.

Closes #2006

Verification at c690612eeb84deef3cce3523b02a2e87128f51c2:

• The compiling Cobra boundary regression failed on unchanged base production code because no error was returned and Run executed.
• Focused race tests passed; the full race-enabled short suite passed in 518.633s with Go 1.26.6 and GOWORK=off.
• Fresh build, golangci-lint 2.10.1, gosec 2.28.0, complexity and installed commit hooks passed. Two independent implementation reviews and two staged reviews were clean; committed patch matches the reviewed patch.
• Fresh macOS CLI startup: mixed/unknown/empty/empty-element/all-services/CSV cases exit 1 with the service diagnostic before Processing services and create no audit file. Valid RDS control reaches the deliberately nonexistent profile error and creates a zero-byte audit file. These checks make no cloud calls or purchases; tests are fixture-based, and real-cloud acceptance is not claimed.

Merge gate pending: independent full-diff review on exact claude-opus-5-5 naming this SHA. Existing cooldown lasts until 2026-10-11T10:00:00Z; no probe or substitute reviewer. CI and CodeRabbit must settle on this head. No merge requested.

[coderabbitai]

Warning

Review limit reached

• Run on-demand review

_{This review includes 6 billable files and costs up to $1.50.}

• Ask an admin to make reviews automatic

Open in CodeRabbit

Reviews can continue after your included limit without a manual trigger. An admin must approve usage-based billing.

Or wait 27 minutes for your next included review.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available. Your 72 included PR review attempts over the past 7 days set your current allowance at 1 review per hour.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

• Configuration used: Repository: LeanerCloud/cloud-commitments-cli/.coderabbit.yaml
• Review profile: CHILL
• Plan: Essentials
• Run ID: eacf23e8-acda-428b-a659-88ee459d7f8b

📥 Commits

Reviewing files that changed from the base of the PR and between 65a02a7 and c690612.

📒 Files selected for processing (6)

• cmd/main.go
• cmd/main_test.go
• cmd/multi_service.go
• cmd/multi_service_helpers.go
• cmd/multi_service_helpers_test.go
• cmd/validators.go

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

_{Comment @coderabbitai help to get the list of available commands.}

[cristim]

@coderabbitai full review

[coderabbitai]

⚠️ Action not completed

Review rate limited.

---

Your included review limit is currently reached under our Fair Usage Limits Policy. Your current included review allowance is based on your included PR review attempts over the past 7 days. This review may still proceed through usage-based billing if eligible. Your next included review will be available in 27 minutes.

[cristim]

CI is green at c690612eeb84deef3cce3523b02a2e87128f51c2: CI - Build & Test run 37668894468 and pre-commit run 37668894472 both completed successfully. The exact committed patch matches the two staged reviews, all installed commit hooks passed, and post-commit focused race tests passed in 4.138s.

CodeRabbit has no submitted review: its included-review limit reply reports 27 minutes from 2026-10-07T18:43:19Z. Recovery is assigned to the controller for one full-review retry after the cooldown and repository-wide window; no paid review was enabled. The required exact claude-opus-5-5 head review remains pending until the existing 2026-10-11T10:00:00Z cooldown. Local reviews do not satisfy that gate. No merge performed.

[cristim]

Independent adversarial review: clean at c690612, performed by a separate Codex reviewer that did not implement the change. The full committed diff matches the independently reviewed patch; no actionable findings across the six review dimensions, scope, reuse or blast radius.

Verification: regression compiles and fails before the fix (unknown input accepted and Run executed), then passes after. Independent actual macOS CLI reproduction: base processes RDS after the mixed typo; final binary rejects mixed/empty selections before processing and creates no audit/report. Valid RDS control still reaches the deliberate missing-profile error. Fresh build, pinned lint/security/complexity checks and full short race suite passed (518.633s); post-commit focused race passed. Fresh exact-head CI check runs all passed with neutral scanner annotations.

CR waived: quota, adversarial review + local verification + green CI. CodeRabbit explicitly reports a rate-limited review for this head; no current review findings were returned. Waived review will be tracked for retrospective full review when included quota is available.

Coverage gap: startup/selection behavior is exercised locally with clean configuration; cloud account inventory and purchases were not exercised. The owner's effective override permits this realistic local path evidence and removes the prior model/account gate. Final head, mergeability and CI will be rechecked immediately before normal protected merge. No purchase, deployment or protection bypass is authorized.