Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@docs/user/cli-reference.md`:
- Around line 1307-1309: The fenced code block following the "**Examples:**"
heading lacks the required blank line for markdownlint MD031; insert one blank
line between the "**Examples:**" line and the opening ```shell fence so the code
block is separated from the preceding paragraph/header (update the section that
contains the "**Examples:**" heading and its subsequent fenced block to include
the blank line).

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@pkg/bundler/config/typed_override.go`:
- Around line 96-103: In WithValueOverridesTypedPaths, reject any
TypedComponentPath entries where tp.Path == "enabled" so non-CLI callers cannot
stash an enabled: override; locate the loop in WithValueOverridesTypedPaths (and
the TypedComponentPath type) and add a guard that fails fast (e.g., panic or
return an error from the caller path if your Option pattern supports errors)
with a clear message referencing "enabled" and the component name instead of
inserting it into c.valueOverridesTyped[tp.Component][tp.Path]; this enforces
the same rejection as pkg/cli/bundle_config.go at the bundler boundary.

In `@pkg/cli/bundle_config.go`:
- Around line 135-146: The current error handling wraps parse errors from
bundlercfg.ParseTypedOverrides(..., decodeSetFileValue) and
bundlercfg.ParseValueOverridesJSON(...) with errors.Wrap, which double-wraps
structured ErrCodeInvalidRequest errors; change those returns to use
errors.PropagateOrWrap(err, errors.ErrCodeInvalidRequest, "invalid --set-file")
and errors.PropagateOrWrap(err, errors.ErrCodeInvalidRequest, "invalid
--set-json") (or simply return the original err) so that structured parse errors
are propagated intact instead of being re-wrapped.
- Around line 182-185: The current os.Open(path) error is always wrapped as
errors.ErrCodeNotFound; change the handling to check os.IsNotExist(err) first
and only map that branch to errors.ErrCodeNotFound, and for all other errors
wrap them with an appropriate fallback code (e.g., errors.ErrCodeIO or a
suitable existing I/O/error code) using errors.Wrap; update the os.Open(path)
error path where errors.Wrap is called so it uses os.IsNotExist(err) to choose
between errors.ErrCodeNotFound and the fallback code.

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@docs/user/cli-reference.md`:
- Line 1342: The heading "Replace an object value (deep-merges into the existing
map)" is contradictory; update the heading text to reflect merge semantics
(e.g., "Update an object value (deep-merges into the existing map)" or "Merge
into an object value (deep-merges into the existing map)") so it no longer
implies replace semantics while preserving the parenthetical note; edit the
heading line in docs/user/cli-reference.md where that exact phrase appears.

In `@pkg/cli/bundle.go`:
- Around line 461-468: Update the --set-json flag help text (the
cli.StringSliceFlag with Name "set-json") to explicitly state that JSON scalars
(booleans, numbers, null) are supported in addition to lists/objects; modify the
Usage string to mention scalar acceptance, adjust the example or add a short
scalar example (e.g., --set-json mycomp:replicas=3 or mycomp:enabled=true) and
clarify that scalars replace existing values while objects deep-merge and lists
replace.

In `@pkg/component/overrides.go`:
- Around line 122-150: The mergeAnyMap implementation currently copies a src map
verbatim when the destination key isn't a map, which preserves nil children as
explicit nulls instead of treating them as "delete" markers; update mergeAnyMap
so that in the branch where you assign dst[k] = serializer.DeepCopyAnyMap(svMap)
you instead iterate svMap and for each entry set dstSub[key] =
DeepCopyAny(value) for non-nil values and delete(dstSub, key) for nil values
(creating dstSub as a new map if needed), so nil children are interpreted as
deletions rather than stored as nulls; refer to mergeAnyMap, svMap, dst and
dst[k] to locate where to change the assignment.

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@pkg/cli/bundle_config.go`:
- Around line 117-175: Move the business rules out of pkg/cli: keep
file-decoding helper (decodeSetFileValue) and raw flag parsing calls (e.g.,
cmd.StringSlice in resolveTypedOverrides) in pkg/cli but relocate precedence
handling (collecting --set-file before --set-json and merge ordering) and the
top-level enabled-path validation (logic that checks tp.Path ==
componentEnabledKey) into pkg/bundler/config (or bundler) so the bundler package
owns the contract; have resolveTypedOverrides call into a new bundlercfg
function that accepts the parsed TypedComponentPath slices (from
bundlercfg.ParseTypedOverrides and bundlercfg.ParseValueOverridesJSON) and
returns the final merged []bundlercfg.TypedComponentPath or an error, preserving
existing error propagation from ParseTypedOverrides/ParseValueOverridesJSON.
- Around line 189-211: In decodeSetFileValue, reject non-regular paths before
calling os.Open: call os.Lstat (or os.Stat) on path first and if it returns
os.ErrNotExist wrap and return errors.ErrCodeNotFound, otherwise if the file
mode is not a regular file (or IsDir) return errors.ErrCodeInvalidRequest with a
message that the --set-file path is not a regular file (or is a directory). Only
proceed to os.Open after confirming the path exists and is a regular file. Keep
existing error codes/messages for NotFound and InvalidRequest to match current
behavior.