fix(cli): print help and require confirmation before destructive uninstall

[metehanulusoy]

Fixes #1038

Problem

uninstall --help performed a real, destructive uninstall (removed all agent configs, skills, hooks, and deleted the binary, exit 0). Root causes, as detailed in the issue:

1. handle_subcommand in main.c matches uninstall positionally before the global --help check can see it.
2. cbm_cmd_uninstall silently ignored unknown flags — --help, -h, or a typo like --dryrun all fell through to a full uninstall.
3. The destructive path (agent-config removal + binary deletion) had no confirmation gate; the only prompt_yn guarded index deletion, so even uninstall -n removed everything.

Fix

• cmd_wants_help() + per-command usage printers: install, uninstall, and update now print usage and exit 0 on --help/-h without touching anything.
• cbm_cmd_uninstall rejects unknown flags with an error + usage (exit 1).
• cbm_cmd_uninstall gates the destructive path behind prompt_yn:
  • -y auto-confirms — unchanged behavior for scripts;
  • -n aborts (previously it still removed configs and the binary);
  • non-TTY stdin without -y fails closed via the existing prompt_yn error;
  • --dry-run skips the prompt (mutates nothing), so the existing scripts/smoke-test.sh phase 6b invocation uninstall --dry-run -y behaves exactly as before.

No wrapper or script in the repo invokes bare uninstall non-interactively (checked Formula/, pkg/, scripts/, install.sh, install.ps1), so the new prompt breaks no automated path.

Behavior after the fix

$ codebase-memory-mcp uninstall --help
Usage: codebase-memory-mcp uninstall [-y|-n] [--dry-run]
...                                          # exit 0, nothing touched

$ codebase-memory-mcp uninstall --dryrun
error: unknown uninstall option: --dryrun    # exit 1, nothing touched

$ codebase-memory-mcp uninstall </dev/null
error: interactive prompt requires a terminal. Use -y or -n flags.
Uninstall cancelled. No files were modified. # exit 1

$ codebase-memory-mcp uninstall -y
...
Uninstall complete.                          # unchanged

Tests

Three regression tests in tests/test_cli.c (run under a temp HOME, using the existing cbm_set_auto_answer_for_test seam):

• cli_uninstall_help_not_destructive — --help exits 0 and leaves the fake install untouched
• cli_uninstall_unknown_flag_rejected — --dryrun typo exits 1 and leaves files untouched
• cli_uninstall_confirmation_gate — declined prompt aborts; -y proceeds and removes the binary

scripts/test.sh (ASan+UBSan) passes locally on macOS arm64. clang-format --dry-run reports zero warnings on both touched files; cppcheck is clean. clang-tidy was not available locally — relying on CI for that layer.

🤖 Generated with Claude Code