Fix attachment missing-message diagnostics

[andrei-hasna]

Summary

• Return not_found when an exact attachment message ID is absent from the active inbox store.
• Preserve missing_required_input only for the distinct case where a resolvable prefix was supplied instead of the exact full ID required by the attachment byte route.
• Add the regression before the implementation change and verify that no output file is created on the missing-message path.

Root cause

The hosted attachment route already accepts the exact hosted message identity and a known-positive attachment downloads successfully. The prior failure was produced by addressing that identity against the local active store, where the message does not exist; the CLI collapsed that case together with the prefix-mismatch case and reported missing_required_input.

Legacy metadata-only attachments remain a separate data-migration boundary. This PR does not invent content, bypass the supported route, mutate mailboxes, or perform a migration.

Validation

• Regression before fix: 1 failing test (not_found expected, missing_required_input received).
• Attachment command block: 19 passed, 0 failed.
• Full inbox command file: 93 passed, 0 failed.
• Adjacent CLI contract: 12 passed, 0 failed.
• CLI build: exit 0.
• Cached diff check: exit 0.
• Staged secret scan: exit 0, no output.
• TypeScript no-emit: resource-bound; Node aborted at the 4 GB heap limit with no TypeScript diagnostic.

Tracking

Todos task: 336c812e-c87a-4bda-b612-eba60d4368d8

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[andrei-hasna]

[REVIEW] GO — #214 @ 49cbe6a — lens: correctness+security+gates, reviewer Hostus (1 of 1)

Reviewed the complete diff from freshly fetched base 4935f87b6f60b10b6fdf7305e175d72f589747e3 to the exact PR head, plus the surrounding attachment command, message lookup/data-source implementations, JSON error classification, attachment download safeguards, out-of-process v1 stub, and adjacent attachment tests.

Commands and gates:

• git log --oneline origin/main..HEAD and git diff origin/main...HEAD --stat: candidate confirmed as one commit changing src/cli/commands/inbox.remote.ts and src/cli/commands/inbox.test.ts.
• bun install: exit 0. Setup only; not reported as a test result.
• bun run test: exit 0 — 4333 pass, 156 skip, 0 fail, 21281 expect() calls; 4489 tests across 290 files.
• No typecheck script is declared in package.json; none was invented or run.

Security/correctness trace:

• A missing message now exits before body, attachment-path, attachment-content, or file-write access and maps to structured error code not_found.
• A resolvable abbreviated ID remains rejected by the distinct exact-full-ID guard before download, preserving the attachment authorization/integrity boundary.
• The regression exercises the real CLI subprocess and confirms exit 1, empty stdout, exact structured error classification, and an empty output directory.

Blocking P0/P1 findings: none.

Non-blocking follow-ups: none.