cli: a listing command refuses a name it cannot answer about

[donislawdev]

Closes O196 and O197.

O196 - the silence

Measured on the built binary before touching anything:

command	was	is
tfg formats png svg	described png, ignored svg, exit 0	exit 2, names svg
tfg preset list some-name	printed the whole list, ignored the name, exit 0	exit 2, names it
tfg preset show <id> extra	exit 2	unchanged
tfg verify a b	exit 2	unchanged

preset list is not in the observation. It came out of measuring the one
that was, and fixing only the named half would have left O196's own sentence -
"two commands answer one question two ways" - true about a different pair.
Flagging it because only formats was authorised.

tfg preset list takes no name at all, so anything after it was always a
mistake, most likely somebody reaching for tfg preset show. The refusal says
so.

O197 - the hand written list

The flag spelling guard named seven directories by hand and internal/damage
arrived on layer 2, under both surfaces, without joining it. The fix derives
the directories from the layer map, so this closes the class rather than the
instance: every later package below the surfaces is covered with nothing to
remember.

The layer map is the right source rather than a walk of internal, for two
reasons. TestLayeringHoldsForEveryPackage already refuses a package that is
neither on the ladder nor declared test only. And it leaves internal/oracle
out on purpose - that one carries three real command lines for inkscape and
ffprobe in raw strings, and a walk would redden on them, which is how a guard
gets switched off inside a week.

Measured: 113 files scanned became 128 (damage 4, legal 7, site 3,
version 1), zero findings - the hole was empty, and it was still a hole.

What it cost

Refusing the extra name pushed internal/cli/preset.go to 439 lines against a
ceiling of 433. Carving beat raising the number: presetcmd.go answers somebody
who typed tfg preset, preset.go turns a named question into targets. The
ratchet then took the ceiling down - longestFile 433 to 408,
crowdedFiles 1 to 0.

The split invalidated three mutation entries and the ceiling change a fourth,
and only staleness.py said so.

Guards

One new guard asking four commands at once, including the two that already
refused - the defect was not a missing check in one place, it was four commands
answering one question two ways. It requires the refusal to name the rejected
word, because an exit code alone is satisfied by a build that refuses
everything, and the control half checks these commands still answer.

Three new mutations plus four retargeted, all eight run and caught.

Verification

• full go test ./... green, gofmt, go vet, staticcheck@v0.8.1 clean
• tools/journey.py 300 of 300
• tools/mutate/staleness.py: 943 patterns, each occurring exactly once
• no generated file moves a byte - this touches argument handling only

🤖 Generated with Claude Code