fix(cli): safe command help and accurate app-first defaults

[Mathieu2301]

Summary

• Make every command accept --help and -h without prompting, accessing the network, or executing the command.
• Document the actual app-first init default, --kind, both artifact paths, and both release fields.
• Prepare CLI 4.0.0-alpha.7 for the existing trusted publishing workflow.

Validation

• CLI typecheck/build and 192 tests pass.
• Root SDK check passes.
• All package/template checks pass.
• No platform, real-home coordinator, physical equipment, or credentials changed.

This removes a verified fresh-agent onboarding failure (pair --help) and misleading artifact instructions. It does not claim the outstanding live owner/guest or two-live-home acceptance.