Input pre-check failures shared by every shortcut — @file/stdin input
resolution, enum validation, and unsupported --dry-run — now leave the
CLI as typed validation envelopes naming the offending flag, so scripts
and AI agents can branch on `param` instead of parsing prose. Wire type,
exit code, and message text are unchanged; the new fields are additive.
The shared layer also gains typed replacements for its legacy
error-producing helpers, so each business domain can migrate to typed
errors without rebuilding common plumbing, and a path-scoped lint guard
keeps migrated domains from sliding back.
Changes:
- Shared pre-check failures (input flags, enum values, dry-run support)
return typed validation errors carrying the offending flag as `param`.
- Every legacy error-producing helper in shortcuts/common has a typed
replacement that preserves the existing message text: validation and
flag-group checks, chat/user ID validation (callers name the flag so
`param` is ground truth), "me" open-id resolution, safe-path checks,
input-stat and save-error wrapping. Legacy helpers stay for
not-yet-migrated domains, marked deprecated — including the legacy
API-result classifier, whose typed route is runtime.CallAPITyped.
- A new errscontract rule rejects legacy common-helper calls on migrated
paths, so a migrated domain cannot silently reintroduce legacy
envelopes; drive is the first locked path and its last legacy
ID-helper calls are replaced.
