feat(cli): cashctl-style errors and help, a network spinner, and ncli profile

[naliyi]

Brings ncli's command UX in line with cashctl, and adds ncli profile.

1. Failures read like cashctl

Three text shapes instead of a timestamped zerolog line plus a help dump on the wrong stream:

invocation	before	after
ncli decode (missing arg)	help on stdout, 2026-09-23T12:27:33Z ERR accepts 1 arg(s), received 0 on stderr, exit 2	help on stderr, no error line, exit 2
ncli miner mnie (typo)	help on stdout + timestamped ERR	Error: unknown command "mnie", blank line, help — all stderr, exit 2
ncli decode --bogusflag	reported twice, exit 1	one report, exit 2
ncli decode notavalid	ERR ...	Error: ... alone, no help, exit 3

Help moved off stdout, where it contradicted AGENTS.md's "a command's result goes to stdout only" and could pollute a pipe into jq. Error: is red only on a real terminal, and never under NO_COLOR — which ncli honoured nowhere before.

Exit codes are unchanged. A bare group command still exits 2, so the friendlier output never turns a mistyped subcommand into apparent success, and --json still emits exactly one structured line and never help. The three skills that said a bare group was "not a silent help dump" are reworded: it does print help now, and still exits 2.

Help is opt-in, mirroring cashctl: UsageError stays help-free for a usage-coded runtime refusal (a relay answering 501 because membership is off; a vault password prompt with no TTY), InvocationError adds error-then-help, HelpError prints help alone. InvocationOrHelp picks between the last two from the args a validator already has.

Two contract violations fixed on the way

• An unknown flag was reported twice — cobra's own Error: + usage dump, with ncli's line stacked under it — and exited 1. Silencing cobra on the root and classifying ExecuteC's own errors in main fixes that, and with it every unwrapped MarkFlagRequired.
• bunker sessions revoke-grant with no --method exited 1 as internal instead of 2 as usage — the one command with MarkFlagRequired and no ValidateRequiredFlags.

2. Spinner on network-facing commands

Log records go through a writer that wipes the in-flight frame first, so the existing per-relay narration still prints and the next tick redraws beneath it — the spinner doesn't cost you the narration.

Off under --json, -q, NO_COLOR and a non-terminal stderr (verified: zero ANSI bytes on captured stderr). Never wired into the commands that own the terminal — apply, ping --tui, bunker, the delegate wizard — or into the long-running relay server.

3. ncli profile <identifier>

 ncli profile

  jack
  no state is the best state

  Identity
    nip-05       ✔ jack@primal.net
    npub         npub1sg6plzptd64u62a878hep2kev88swjh3tw00gjsfl8f237lmu63q0uf63m
    pubkey       82341f882b6eabcd2ba7f1ef90aad961cf074af15b9ef44a09f9d2a8fbfbe6a2
    lightning    ⚡ jack@primal.net
    website      — not set

  Following      — not published

  Relays (6)
    ↕  wss://relay.damus.io
    ↕  wss://relay.primal.net
    ...

  Blossom        — not published (no kind:10063)

  queried 1 relay(s) · profile updated 2026-06-04

One subscription over kind:0, kind:3 (following count), kind:10002 (NIP-65) and kind:10063 (Blossom). Takes npub, hex, nprofile, a nip-05 address, or a vault label.

Two deliberate differences from find:

• Aggregates across every target rather than stopping at the first match (QueryTargets, not Find) — a relay list very often lives on a different relay than the profile.
• An identity that published nothing renders sparse at exit 0, not not_found. Every section still prints as "not published", so absent stays distinguishable from zero; in --json those fields are omitted rather than zeroed.

nip-05 is verified against its domain by default; a lookup that can't complete reports as unverifiable (⚠) rather than as a failed verification. --no-verify skips it.

Verification

• go build ./..., go vet ./..., go test -short ./... all clean (GOWORK=off).
• New tests: the three HelpMode shapes with stdout asserted empty, --json never dumping help, errorPrefix/NO_COLOR, IsBareInvocation, and the spinner (frames written, nothing when disabled, goroutine joined before return, no nesting, error propagated).
• Two test failures during development caught two real bugs: IsBareInvocation used Visit instead of VisitAll+Changed, which made every flags-only invocation look bare.
• ncli profile verified end to end against relay.primal.net — real metadata, a genuine nip-05 HTTPS verification, a six-relay NIP-65 list.

Note

origin/worktree-trim-id-help is no longer a conflict: satoshi is already the vault-label placeholder on main, contrary to an earlier reading.