fix: make yaml formatting side-effect free

[2830500285]

Summary

• make YAML formatting return bytes like the other output formats instead of writing directly to stdout
• keep ShowJSON / iterator callers responsible for writing output, so YAML can be buffered, counted, and paged consistently
• add regression coverage for the formatter side effect and the ShowJSON YAML output path

No linked issue; I found this while looking for another runtime correctness fix after the currently open issues were already covered by existing PRs.

Validation

• go test ./pkg/cmd -run 'TestFormatJSON|TestShowJSONYAML|TestShowJSONIterator'
• go test ./... -run 'TestFormatJSON|TestShowJSONYAML|TestShowJSONIterator'
• go build ./...

Note: I also attempted go test ./... locally, but this Windows environment is missing /bin/bash for the autocomplete tests and does not have the mock server running on localhost:4010 for generated command tests.

[markstuart-oai]

@codex review

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-06T01:29:54.598725Z	490acd4	Manual request
🔒 Security Review	✅ Completed 2026-09-06T01:31:17.940855Z	490acd4	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Chef's kiss.

Reviewed commit: 490acd47ef

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Security review completed. No security issues were found in this pull request.

Reviewed commit: 490acd47ef

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

• You comment "@codex security review"
• A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

[saioai]

yaml output can fetch another page after reaching --max-items and fail unnecessarily. please rebase onto main, preserve its pagination limit fix, and add a regression test.