Fix CVE sync reliability and per-subcommand CLI help (v0.2.1)

[FGH-2]

Improve NVD fetch error messages and proxy-safe body decoding, make --years imply --full for year feed syncs, and route each top-level CLI subcommand through a dedicated parser so --help shows only relevant flags.

Summary

This release fixes confusing CVE sync failures (especially through proxychains), corrects --years feed behavior, and gives every top-level CLI subcommand its own --help output with only relevant flags.

CVE sync fixes

"error decoding response body" (month sync via proxychains)

• Root cause: gzip-compressed NVD API responses getting garbled/truncated through proxychains.
• Fix: On body decode failure, automatically retry with Accept-Encoding: identity.
• Applied to text (API/meta) and bytes (gzip feed) responses.
• Errors now include the URL, HTTP status, and actionable guidance (proxy vs rate limit vs NVD_API_KEY).

"HTTP 404 Not Found" (cve sync --years 2025)

• Not rate limiting — 404 means the requested URL does not exist.
• Root cause: --years was silently ignored unless --full was also passed, so the command only fetched incremental modified/recent feeds instead of year feeds.
• Fix: --years now implies --full and prints a notice when that happens.
• 404 errors now include the URL and a hint about year feed usage.

Other NVD error improvements

• Removed duplicate nvd: nvd: error prefix; errors use {e:#} for full context.
• HTTP errors include response body snippets and status-specific hints (404 feed names, 403/429 rate-limit guidance).

CLI help improvements

Previously, chronosphere cve --help (and other subcommands) showed global engagement flags (-e, -t, -c, etc.) even when irrelevant.

• Each top-level subcommand now has a dedicated *Cli parser via early dispatch (try_early_dispatch).
• Engagement-aware commands (run, targets, list, …): engagement flags appear under an Engagement section.
• Standalone commands (cve, where, deploy, mcp-config, …): no engagement clutter.
• Nested subcommands work correctly: chronosphere targets add --help shows add flags plus engagement options.

Files changed

File	Change
src/cve/rate_limit.rs	Proxy-safe body read, identity-encoding retry, richer HTTP errors
src/cve/providers/nvd.rs	Use get_text / get_bytes helpers
src/cve/sync.rs	--years implies --full; clearer NVD error messages
src/cli.rs	EngagementOpts, per-subcommand parsers, try_early_dispatch
src/main.rs	Early subcommand dispatch before root parse
Cargo.toml / Cargo.lock	Version 0.2.1

Test plan

• chronosphere cve sync --month 2026-03 through proxychains completes NVD import
• chronosphere cve sync --years 2025 downloads nvdcve-2.0-2025 (not modified/recent only)
• chronosphere cve --help — no engagement flags; examples shown
• chronosphere cve sync --help — sync flags only
• chronosphere run --help — run flags + Engagement section
• chronosphere targets add --help — add flags + Engagement section
• chronosphere where --help — minimal (no engagement)
• chronosphere deploy --help — deploy flags only
• chronosphere -e lab run <cmd-id> still works with leading engagement flags
• cargo test cve passes