chore: guard empty profile source and document credential wire fields

- buildCredentialProvider no longer records a phantom env profile source
  when no profile is selected.
- ERROR_CONTRACT.md documents the credential/identity-selection extension
  fields (missing_keys, required_any_of, profile, app_id,
  credential_source, profile_app_id/env_app_id).
- profile --help names the full auth status --json --verify form.
- Drop a stale out-of-repo spec reference from the CredentialSource
  comment.

cmd/profile/profile.go

@@ -18,7 +18,7 @@ func NewCmdProfile(f *cmdutil.Factory) *cobra.Command {
 
 Profile selection:
   lark-cli whoami --json       Show the app/profile lark-cli is using now.
-  lark-cli auth status --json  Verify OAuth login and token state.
+  lark-cli auth status --json --verify  Verify OAuth login and token state.
   --profile <name>             Use a profile for this command only.
   LARKSUITE_CLI_PROFILE        Use a profile for the current shell / agent session.
   config show / profile list   Inspect saved config, not current usage.

errs/ERROR_CONTRACT.md

@@ -67,6 +67,17 @@ Typed errors render to **stderr** as one JSON object per process exit:
 | `error.params` | per-Subtype-stable | per-parameter validation detail array (`ValidationError`); see **Validation parameters** |
 | per-Subtype extension fields | per-Subtype-stable | e.g. `missing_scopes`, `console_url`, `challenge_url` |
 
+Credential/identity-selection extension fields (per-Subtype-stable):
+
+| Field | Carrier | Subtypes | Notes |
+|-------|---------|----------|-------|
+| `missing_keys` | `ConfigError` | `app_credential_incomplete` | env var NAMES that must all be set; never values |
+| `required_any_of` | `ConfigError` | `app_credential_incomplete` | env var NAMES where any one completes the credential; mutually exclusive with `missing_keys` |
+| `profile` | `ConfigError` | `profile_not_found`, `profile_secret_invalid` | requested profile name |
+| `app_id` | `ConfigError` | `profile_secret_invalid` | plaintext app id; never a secret |
+| `credential_source` | `ConfigError` | `profile_not_found`, `no_active_profile` | how the identity was (not) chosen: `flag:--profile` \| `env:LARKSUITE_CLI_PROFILE` \| `config` |
+| `profile_app_id`, `env_app_id` | `ValidationError` | `profile_app_credential_conflict` | the two conflicting plaintext app ids |
+
 `SecurityPolicyError` renders through the same typed envelope as every
 other category. `error.type` is `"policy"`, `error.subtype` is one of
 `challenge_required` / `access_denied`, and process exit is `6` via

errs/types.go

@@ -331,7 +331,7 @@ type ConfigError struct {
 	// CredentialSource is the machine-readable App/credential selection source
 	// that produced this config error (e.g. "flag:--profile",
 	// "env:LARKSUITE_CLI_PROFILE", "config"). It is required on
-	// profile_not_found and no_active_profile (spec §5) so an agent can branch
+	// profile_not_found and no_active_profile so an agent can branch
 	// on how the identity was (or was not) chosen. It is never a secret.
 	CredentialSource string `json:"credential_source,omitempty"`
 	Cause            error  `json:"-"`

internal/cmdutil/factory_default.go

@@ -193,6 +193,10 @@ func buildCredentialProvider(deps credentialDeps) *credential.CredentialProvider
 	// provider clears unverified identity fields), so silencing the
 	// warning is safe.
 	cred := credential.NewCredentialProvider(providers, defaultAcct, defaultToken, deps.HttpClient)
+	if deps.Profile == "" {
+		// No profile selected — don't record a phantom env source.
+		return cred
+	}
 	if deps.ProfileFromFlag {
 		return cred.WithProfileFromFlag(deps.Profile)
 	}