Teach the public CLI test harness to exercise rendered commands

[ScriptedAlchemy]

Summary

Close the remaining gap between production rendered CLI routes and the public Agent Bundle test harness. A consumer should be able to exercise a routed JSX/TSX CLI command through the same render-session and output-mode behavior used by the generated executable.

Verified gap

Production rendered CLI commands now use the generated render-session path, but packages/agent-bundle/src/test/cli.ts still documents and implements a plain-command-only bridge. Its invokeCli path calls the route export directly and validates the returned value; it does not drive the rendered command's Flight/Agent Document projection.

The original parent, #103, is closed. Its stated scope included real CLI/script projection helpers, but the rendered CLI proof currently lives in package-specific route-unit/build tests rather than the public agent-bundle/test harness.

Relationship to existing work

• Generate CLI, MCPorter, and script projections from the compiled route graph #102 owns routed CLI/script generation and output modes.
• Generate an Agent Bundle framework test harness on top of Rstest #103 delivered the public framework test harness but closed without this rendered-command path.
• Generated plugin contract matrix: catch source→artifact→dev→installed-host drift before release #218 owns the broader source-to-packed-to-installed-host contract matrix.

This issue is the focused consumer-harness follow-up.

Acceptance criteria

• invokeCli, or a clearly named sibling API, detects rendered commands and drives the same render-session path as the generated CLI entry.
• The harness can assert Markdown/TTY, JSON, and NDJSON behavior for a JSX/TSX CLI route.
• Cancellation, render errors, result-schema errors, and protocol-purity behavior match production.
• A projection test exercises a rendered CLI command end to end at the public CLI-dispatch proof level.
• Stale comments claiming rendered commands cannot reach the harness are removed.
• The scaffolder documentation explains which proof level to use for plain versus rendered commands.

[ScriptedAlchemy]

Delivered in #266 (merged as 0131bc6) against every acceptance criterion:

• Rendered detection + render session: invokeCli itself now drives rendered commands — the shell's compiled rendered flag is the detection, and the harness installs an in-process render session mirroring the generated executable's (events() from the runtime dispatcher's public stream(), validate = the route's resultSchema.parse, same invocation/request-scope shapes, cwd-derived workspace per fix(test): honest registry version gate, binary-faithful CLI cwd, README field #206). Rendered route modules are preloaded so inputSchema.parse runs synchronously inside the render factory — an input rejection stays a usage failure (exit 2), matching the generated render bridge byte-for-behavior. No second rendering path: the CLI session shares render.ts's Flight-dispatcher wiring (and mountManifestState, pinned by the fixture's stateMounted: z.literal(true)).
• Markdown/TTY/JSON/NDJSON: piped Markdown is the deterministic default; InvokeCliOptions.tty selects interactive projection (progress in place via \r\x1b[2K); --json yields the canonical validated value (also surfaced as invocation.value); new cliNdjson() returns the ordered CliRenderedEvent[] with honest AgentTestError diagnostics otherwise.
• Cancellation / errors / purity: projection tests pin mid-render abort (Aborted., exit 1), component render errors on stderr (exit 1), resultSchema rejection (exit 1), rendered inputSchema rejection (exit 2 + usage hint), --ndjson on a plain command and --json --ndjson conflicts (exit 2), monotonic NDJSON sequences ending in complete, and no jsonrpc key anywhere (CLI dialect, never MCP JSON-RPC).
• End-to-end projection test: tests/projection/cli-dispatch-rendered.test.ts exercises the new rendered fixture command (route-harness/src/cli/report.tsx) through the public agent-bundle/test exports, in the in-process projection pool — zero cost added to the packed pool.
• Stale comments: the src/test/cli.ts header no longer claims rendered routes are an AB4816 compiler error; it now states honestly what cli-dispatch does not prove (no worker thread, no process framing, no chunk-by-chunk Flight timing — cli-routes-build.test.ts owns that at the packed level).
• Scaffolder docs: the cli-tool template README now explains plain vs rendered proof levels (invokeCli/cliJson for both, cliNdjson + tty for rendered modes, packed suite for process evidence); the package README table/example updated to match.

Local gates on the branch: projection pool green (10 new rendered-dispatch tests), unit 2366 passed / 5 skipped / 0 failed, route-unit 15/15, tsc --noEmit clean across all three projects, rslint 0 errors / 0 warnings. Ships as a minor agent-bundle changeset.