GeezerVison

…cal vars

parse_bool_flag everywhere: get --save-only/--one-off and remove
--skip-rollback had clap's default bool-from-env (SOCKET_X=1 or an
exported-but-empty var aborted the parse — same bug class fixed on
rollback/repair/unlock/vex earlier); apply --check, setup --check/--remove,
and get/scan --all-releases dropped BoolishValueParser (rejects VAR=).
SOCKET_STRICT was missing from GLOBAL_ARG_ENV_VARS despite the list's
'every env var GlobalArgs binds' contract. New LOCAL_ARG_ENV_VARS mirrors
that contract for subcommand flags; the main-run scrub and the test
harness's clean-env helper now cover both lists. Two table-driven
invariant tests parse every binding against its owning subcommand with
'', '1', 'yes', 'garbage' so the policy self-enforces (RED-verified
against the pre-fix get.rs).

Co-Authored-By: Claude Fable 5 <[email protected]>

remove was the one mutating command that silently ignored the global
--dry-run (contract row: 'Preview, no mutations') and deleted anyway.
Now: lock/emit carry dry_run; the confirmation prompt is skipped (nothing
to confirm); rollback and vendor-revert run their existing dry-run modes;
the manifest removal is simulated in memory so the blob sweep previews
against the post-removal reference set; the envelope reports dryRun:true
with would-be Removed events flipped to Verified previews (the
apply/vendor/repair convention) so summary.removed stays 'entries
actually deleted'. Telemetry does not fire on previews. Contract lines
103/763 updated. +2 invariant tests (RED-verified against the old code).

Co-Authored-By: Claude Fable 5 <[email protected]>

The flag parsed but was never read past the --save-only conflict check —
the patch was saved to the manifest regardless, lying about persistence.
It now errors 'One-off get mode is not yet implemented' up front (before
any network/disk activity), mirroring rollback --one-off's contract.
Contract env-table row documents both stubs; the in_process_get caveat
test now pins the honest error instead of the accidental behavior.

Co-Authored-By: Claude Fable 5 <[email protected]>

resolve_mode_flags previously folded --mode INTO the legacy booleans
(--redirect/--vendor/--apply), leaving the deprecated spellings as the
internal truth. Now the booleans fold into args.mode and are never read
past the fold; run() derives apply/vendor/hosted locals from the enum.
Error messages are byte-identical (pinned by scan_vendor_e2e). Legacy
boolean help text now says 'Deprecated spelling of --mode X'. Contract
tests updated to pin the new direction (modeless scan stays read-only,
--sync == --mode agent --prune).

Co-Authored-By: Claude Fable 5 <[email protected]>