CLI papercuts: --help handling, fold TTY hang, wasm magic pre-check, suite --name

[lann]

From the adversarial review (2026-08-04). Batch of verified CLI papercuts (ct-runner usage/parse-error fixes already landed in a4016a3):

1. --help is a loaded footgun on every binary/subcommand: component-test lock --help → Error: reading --help ... No such file or directory; same for fold --help; ct-runner --help → exit 2 with the same shape. Any leading unknown flag is consumed as the input path. Fix: reject positional args starting with -; handle -h/--help/--version explicitly in each hand-rolled parser (three small match arms; no clap needed).
2. component-test fold with no stdin redirect blocks forever (stdin read precedes all validation). If stdin is a TTY, print a note to stderr or error out (std::io::IsTerminal).
3. Wrong-file-type errors expose parser internals: ct-runner README.md → expected `(` --> <anon>:1:1 (WAT parser on markdown); component-test lock README.md → hex dump of the bad magic. Pre-check the wasm magic and say "not a WebAssembly component: ".
4. Suite identity is the artifact filename stem — one suite ends up with three names (crate sample-suite, case root sample, recorded sample_suite), and results consumers key off the recorded one. Add --name to ct-runner and component-test lock, or default to the inventory's common root segment. Note the envelope/lockfile suite-name cross-check (a4016a3) currently only warns, partly because of this.

Related: #13.

[lann]

All but --name landed in 38faf9a on adversarial-multi-agent:

• -h/--help/--version on both binaries and every subcommand; leading unknown flags rejected instead of consumed as paths
• fold prints a stderr note when stdin is a TTY instead of blocking silently
• wasm magic pre-check in both component-test lock and Runner::new ("not a WebAssembly binary" instead of WAT-parser internals / hex dump)

Remaining in this issue: item 4, the suite --name override — it has a real design question (flag vs. deriving from the inventory's common root segment, and how either interacts with the envelope/lockfile suite-name cross-check that currently warns on mismatch).