fix(cli): close eval gaps for formats, profiles, and plugins

[ankitranjan7]

Description

Repairs product-side eval gaps in CLI parsing, plugin management, and local profile lifecycle.

Closes #373
Closes #376
Closes #377

• plugin update: dirty sibling in the shared monorepo blocks updating a different plugin #373: plugin update <name> replaces that plugin's source subtree plus generated shared install artifacts without replacing dirty sibling source. Each published monorepo commit remains available as the next update baseline, including across consecutive updates.
• cli: --json rejected where --format json works; site fixture/memory still reject -f and --stdin #376: --json aliases --format json; explicit --format or -f (including attached -fyaml) wins regardless of argument order in execution, structured help, and early errors. Site memory and fixture commands accept the documented format and stdin forms.
• profile: no create command; unknown --profile fails as Session not found #377 (local mode): profile create <alias> provisions an idempotent local Cloak profile, while an unknown explicit profile reports PROFILE_NOT_FOUND with recovery commands.
• plugin install: github:agentrhq/webcmd installs 122 plugins with no warning #380 partial, local mode only, not closing: local monorepo-root installs require an explicit --all or a plugin subpath; help shows the per-plugin source form, and search keeps installSource first. Hosted --all fails locally with a normalized CONFIG error before any marketplace request and points to a single plugin or local mode. Hosted monorepo-wide installation remains open until Webcmd Cloud supports that operation.
• fetch: a raw 403 does not steer agents to webcmd web fetch #374 partial, not closing: product list/help metadata makes web fetch discoverable from blocked, 403, and Cloudflare language. Agent skill guidance is intentionally excluded from this product PR.
• browser: SESSION_BUSY is unreachable; data: URLs disable localStorage #378 partial, not closing: overlapping browser runs surface structured SESSION_BUSY with consistent wait-and-retry guidance, and data: URL storage failures name the limitation. The issue remains open for its full end-to-end workflow.
• Not addressed: browser: window.open does not appear in browser tabs #375 and browser run: page downloads never fire; no discoverable artifact retrieval after #339 #379.

Related issues: #373, #374, #375, #376, #377, #378, #379, #380

Type of Change

• 🐛 Bug fix
• ✨ New feature
• 🌐 New site adapter
• 📝 Documentation
• ♻️ Refactor
• 🔧 CI / build / tooling

Checklist

• I ran the checks relevant to this PR
• I updated tests or docs if needed
• I included output or screenshots when useful
• If I edited skill-src/, I ran make build and committed skills/

Adapter Notes

• Updated generated or lean docs when command discoverability changed
• Used positional args for the command's primary subject unless a named flag is clearly better
• Normalized expected adapter failures to CliError subclasses instead of raw Error

Screenshots / Output

Fresh local verification on Node v22.17.0:

• npm ci — passed (171 packages installed)
• npm run typecheck — passed
• npm run build — passed (1 CLI manifest entry; 842 plugin command entries)
• npm test — passed (445 files; 5,811 tests passed; 1 skipped)

[github-actions]

🟠 Maintainer review suggested — low confidence

The automated review could not reach a fully supported conclusion.

Limitations

• The automated review returned an invalid structured result.

This review is advisory and does not block merging.