Summary

• The `help` header now shows the current execution mode: `rshell (v0.0.21) - read-only mode` or `- remediation mode`
• Introduces `RemediationOnly bool` on the `Command` and `CommandMeta` structs so builtins can declare they require remediation mode
• `truncate` is marked `RemediationOnly: true` — in read-only mode it moves from the enabled Commands table to the Disabled commands list, matching what actually happens when you try to run it
• `RemediationMode bool` is added to `CallContext` and wired from `runner_exec.go`

Test plan

• New scenarios `help_readonly_mode.yaml` and `help_remediation_mode.yaml` verify the mode string in the header
• Updated `unrestricted_all_flag.yaml` runs in remediation mode so `truncate` stays in the enabled list and "All commands are allowed" still appears
• Unit tests updated: `TestHelpListsAllCommands` and `TestHelpAllFlagNoRestrictions` use remediation mode; four `tableLines` calls broadened from `"Commands:"` to `"Commands"` prefix to handle both `Commands:` and `Commands (N of M enabled):` headers

🤖 Generated with Claude Code