chore(bootstrap): share native CLI test fixtures - #48

Summary

• Extract shared native CLI fixtures used immediately by the existing minimal-config test. Both public helpers have current callers; no future-only builder or new product API is introduced.
• Replace inline stub reply branches with trusted local JSON fixture data and add one test for argv capture, unknown-request fail-closed behavior, and malformed data.
• Remove one separately authorized unused local declaration to resolve a pre-existing LSP hint, retaining every existing assertion.

Validation

• Focused checks passed: 2 cases, including the existing native CLI plan/apply characterization.
• Full local suite passed: 182/182 on LF and physical CRLF, no failures or skips on Linux/Node 24.20.0 (181 baseline + 1 new).
• Documentation updated for helper interfaces, trusted fixture data, simple-token args.join(" ") collision limits, and platform boundaries.
• Active LSP: both changed MJS files clean, zero diagnostics and inconclusive outcomes.
• Gitleaks/actionlint fixtures: 4 cases each on LF and CRLF; normal workflow inventory/lint passed on both line endings using pinned approved binaries. Shellcheck is disabled, not claimed as passed.
• Strict security scans: intended 64-file source and reachable local delivery history (35 commits), zero findings.
• Clean offline npm pack --ignore-scripts: exactly 64 regular members, all byte-identical to the selected source. Package SHA256: 0385ac5248003191a4a7e4b73ed1b5ff9364b6dc9c29dfeb5c2e2ec7031115b6.
• Required hosted aggregate test passes for this PR head (automatic CI pending at submission).

Independent technical verification reproduced source counts, preserved assertions, LF/CRLF checks, security scans, and package bytes. Windows C# launcher code is byte-identical to the prior launcher, but Windows/macOS/hosted Node 20 execution remains for automatic CI. No skill-load, live GitHub/Projects, stored-secret, sandbox, or LLM proof is claimed.

Linked issue

Refs #15

This is a nonclosing reference. D1 supplies test infrastructure only; remaining package/migration/activation acceptance, later characterization/refactor/API units, and release decisions are not completed by this PR.

PR type

• Bug fix
• New feature
• Documentation only
• Code refactoring
• Maintenance/tooling (type:chore)
• Breaking change

Changes

284 changed lines = 201 additions + 83 deletions, counting helper moves twice. No test/assertion removal, code golf, deferred essential tests/docs, product module changes, schema/default/flag/version changes, or cleanup.

Verification boundaries and process record

The first complete candidate was measured in RAM before writing. One line-count-neutral expected-log fix was re-measured after, rather than before, its write; that process deviation is retained in local evidence and not retro-authorized. Subsequent documentation and single-declaration fixes had complete pre-write measurements.

The mechanical extraction was characterized functionally. The new fixture-data guard was tested after implementation; an owned negative control changing unknown-request exit 1 to 0 makes the new test fail by assertion. This is post-hoc safety refutation, not historical test-first RED. The initial incorrect double-bracket expectation is not reported as a bug RED.

The stub's data is locally supplied and trusted. JSON values are written to stdout without eval or request-derived executable code interpolation; it is not a security sandbox, universal argv filter, credential validator, or GraphQL/stdin/pagination implementation.

Contributor checklist

• Approved issue linked with Refs #15, no automatic closure.
• Exactly one requested type label: type:chore.
• Local applicable checks and independent verification completed.
• Docs accompany the unit; no changed skill implementation or shell script requiring agent-load/shellcheck claims.
• Conventional commit, with no Co-Authored-By trailer.
• Required hosted CI completed; human review/merge remains separate.

Published as a draft. No assistant ready/merge, workflow dispatch/rerun, issue closure, new tag/release, activation, or cleanup is authorized.