Add reliable CLI automation errors and download recovery

[TheDesignFounder]

A script can currently receive plain-text errors despite requesting JSON, and recovering a missing local output can lead users to rerun paid generation. Add consistent JSON errors with recovery identifiers, subcommand help, and download EXECUTION_ID --out FILE to retrieve existing output using GET requests only. Download refuses to overwrite existing files.

Document exit codes, noninteractive behavior, and the fact that rerunning a file command creates a new upload rather than an identical request. Prepare 0.4.0-beta.2 while leaving the stable distribution tag unchanged.

Validation: 55 tests pass on Node 22.12, including packaged installation, JSON privacy, help without credentials, GET-only recovery and overwrite protection. npm pack inspection passes. No paid calls.

Publishing is pending authenticated npm access; npm whoami returned E401 locally. Release instructions are in RELEASE.md. Documentation links accompany the Agent API readiness PR in Abloh.

[TheDesignFounder]

Post-merge independent review (merge 05ad729): fix before publishing 0.4.0-beta.2

Read at the merge commit, 55/55 tests run locally, binaries probed against a fake API. No live calls, nothing published.

Fix before publish

1. src/cli.ts:464-471: a local-output failure after a completed, charged run (read-only --out dir, EACCES; download overwrite refusal EEXIST; dangling symlink) is reported in JSON as INTERNAL_ERROR / generation_failed / retryable: false. The README tells scripts to branch on reason, so they will conclude the generation failed and resubmit, paying twice. execution_id and idempotency_key are present, which is what makes recovery possible, but the reason contradicts them. Needs a distinct reason (for example local_output_failed, retryable via download).
2. src/cli.ts:514-516: same scenario in text mode prints the raw EACCES message and exits 1 with no execution id and no dreamlayer download hint; recoveryHint() only fires when consume() throws, and here the stream completed. This is the PR's headline scenario, unfixed for non-JSON users.
3. src/cli.ts:465-467: every UsageError collapses to one envelope (VALIDATION_FAILED / invalid_request, exit 1): missing API key, unreadable input file, download on a still-running execution, and bad arguments are indistinguishable, and the help table says auth is exit 2. Give each cause its own reason/exit while keeping the sanitised message.
4. src/client.ts:706, 711, 720 via cli.ts:465: follow()'s terminal errors ("still active", "ended before an identifier", "no downloadable asset yet") map to generation_failed / retryable: false although the job is running or the key should be reused.
5. README.md:146-151 and the help text at cli.ts:75 link to docs.dreamlayer.io/cli/automation, /agent-api/limits, /agent-api/examples, /mcp/tools, all 404 until Abloh #460 is merged and published. Publish after the docs, or drop the links.
6. package.json: no publishConfig.tag. "Without moving the stable dist-tag" currently depends on the operator typing npm publish --tag beta; a bare publish makes beta.2 latest (registry today: latest 0.3.0, beta 0.4.0-beta.1). Add publishConfig.tag: "beta".
7. src/cli.ts:238-240: a cancelled outcome in --json goes to stdout with exit 5 and nothing on stderr, while the new README says structured errors go to stderr and 5 means "temporary, worth retrying". Pre-existing behaviour, newly documented incorrectly.

Tests: test/cli.test.mjs:987-993 ("JSON usage errors do not leak local arguments") fails on a message that never contained the path, so it would pass even if error.message were echoed; test the real cannot read <file> path (cli.ts:187, which is safe in JSON mode). The download test asserts only exit 1 on overwrite, not the envelope (which would have exposed item 1), and skips the not-completed and multi-asset branches.

Low: shipped dist/*.js keeps comments carrying internal deploy identifiers and incident narratives (client.ts:40-45); -h anywhere in argv short-circuits and the in-branch JSON help path at cli.ts:486-488 is dead; the asset bytes are fetched before the destination existence check (cli.ts:417-418).

Verified: download is GET-only (GET /v1/executions/{id} then the asset URL, never POST /v1/execute); overwrite refusal uses O_EXCL with no check-then-write race (existing file, dangling symlink and symlink-to-file all refused); every failure path yields a parseable JSON envelope on stderr; exit codes 2/3/4/5/6 match the table; the retry key is generated once and appears in success, question, non-completed and error envelopes; packaged-install test really packs, installs and runs the binary; no unreleased features or internal names in README, RELEASE.md or package.json.

Verdict: publish 0.4.0-beta.2 only with an explicit --tag beta, after items 1 and 2 at minimum and after the docs are live.