Preserve actionable CLI errors and recovery guidance

[TheDesignFounder]

CLI errors now preserve useful transport categories without exposing URLs or credentials, avoid download advice for cancelled executions, and retain authentication/access exit code 2 when asset retrieval returns 401/403. Help is parsed as an option so literal -h option values no longer replace the requested command with help output.

Includes binary-level regression tests against local fixtures and prepares 0.4.0-beta.3 under the beta tag. No paid calls; latest remains 0.3.0.

[TheDesignFounder]

Post-publication review of #8 (beta.3, main f18dbdd): verified against the published package

The published dreamlayer@0.4.0-beta.3 dist is byte-identical to a local build of main; 81/81 tests pass. Probed the published binary against a fake API:

• N2 FIXED: a refused connection now reads Connection refused (ECONNREFUSED). Execution state is uncertain… with the saved key and no prompt, host or key leaked; an unmapped socket error falls back to Transport connection failed. (checked on port 1), which is acceptable.
• N3 FIXED: cancelled text output suggests status only, no download, no blank line; exit 4.
• N4 FIXED: an asset fetch answering 401/403 now exits 2 with authentication_failed/access_denied, carries the execution id, and does not echo upstream text.
• 15 FIXED: --idempotency-key -h is preserved and sent as the key; generate … --help prints usage with no key and no network call.
• API errors with --json still emit the JSON envelope (402 → insufficient_credits, exit 3); the removed branch was dead code.

Nit for later: the cancelled text path prints the bare message without the execution_cancelled reason string that the JSON path carries; harmless.