fix(tui): wire recipe dispatcher through newRootCmdForRecipeStep

[jklaassenjc]

Summary

• 3-line follow-up to PRs feat(tui): add wizard-style recipe runner #14 (TUI runner) and fix(recipe): stop -t from leaking into subsequent dispatched steps #15 (viper leak fix)
• Switches the TUI's recipe dispatcher factory from the inline lambda to the newRootCmdForRecipeStep helper added in fix(recipe): stop -t from leaking into subsequent dispatched steps #15
• Closes the last gap between CLI jc recipe run and the TUI Recipe runner

Why

#14 and #15 were split for cleaner review: #15 predates the runner and fixes a bug on the CLI path too, so it didn't need to be bundled. The cost was this tail — while #15 made jc recipe run security-audit work again, the TUI's dispatcher in internal/cmd/tui.go was still wired through an inline func() { return NewRootCmd() } that bypassed the viper reset. Recipes with capturing steps after -t steps (security-audit, compliance-report) would still misrender from the TUI.

Test plan

• go build ./... clean
• go test ./... — all suites pass unchanged
• Local TUI smoke: run security-audit via jc tui → Recipes, verify Auth failures in last 7 days: 0 instead of the old <no value>

🤖 Generated with Claude Code

---

Note

Low Risk
Low risk wiring change confined to the TUI recipe dispatcher; behavior should only differ by preventing output-format/viper state leakage across recipe steps.

Overview
Fixes the TUI Recipes runner to build its dispatcher with newRootCmdForRecipeStep (instead of an inline NewRootCmd factory), so persistent viper keys are reset between steps.

This prevents a -t step from leaking table output settings into later JSON-capturing steps, aligning TUI recipe execution with jc recipe run.

^{Reviewed by Cursor Bugbot for commit 0a786f4. Bugbot is set up for automated code reviews on this repo. Configure here.}