0.24.0 release-test hygiene batch: check-count inconsistency, detect ANSI leak, red-team dir handling, and 4 more

[thebenignhacker]

Minor findings from the 0.24.0 fresh-user walkthrough (21/21 commands). All reproduce on 0.23.11-era code paths; none block release. Batch into a future release.

1. Check-count inconsistency across surfaces: top-level --help says "323 checks / 74 categories"; per-scan Observations line says "209 static · 3 semantic"; mcp-serve tool description says "187 security checks across 39 categories". check-metadata confirms 323 entries. The subsets (209, 187) are real but undocumented — either label them ("209 static checks of 323 total") or derive all three from one source.
2. detect leaks ANSI escapes to non-TTY stdout (24 ESC sequences on a bare pipe). secure/scan-soul/check all auto-strip on pipe; detect only respects NO_COLOR/--no-color explicitly. CI users redirecting to a file get raw codes.
3. red-team requires a file, not a directory: red-team <skill-dir> → "Cannot read file: " with no hint, while check/secure accept directories. Either accept a directory (resolve SKILL.md) or say "point at a SKILL.md file, e.g. red-team /SKILL.md".
4. pull-stubs surfaces a raw internal exception when INTERNAL_API_KEY contains a non-Latin1 character: "Cannot convert argument to a ByteString because the character at index 8 has a value of 65533". Exit code is correctly 1; the message should be a clean validation error.
5. wild runs ~45s with no progress indicator (network fetch, 48 pages). Add a spinner/progress line so fresh users don't assume a hang.
6. fix-all --dry-run prints "Fixed 3" during a preview where nothing is modified. Wording should be "Would fix 3".
7. Quick-start banner repeats at the top of every subcommand --help/no-args output. Minor noise; consider printing it only on the bare invocation.

[thebenignhacker]

0.25.0 release testing — two additions to this batch:

• Item 4 (pull-stubs ByteString error) also fires with INTERNAL_API_KEY simply unset, not only non-Latin1: Cannot convert argument to a ByteString because the character at index 8 has a value of 65533... after Error: Could not reach the registry. The unset case should print "Set INTERNAL_API_KEY to authenticate" before ever building the header.
• New item 8: check <unknown-npm-package> --no-scan ignores the flag and falls back to "Running local scan... Downloading..." — contradicts the documented "registry only, skip local scan" contract (the GitHub path got this right in 0.23.7 via the not-found block; the npm path still falls through).
• New item 9: the once-per-scan "opena2a is a separate CLI — install with: npm i -g opena2a" disclaimer renders at the very bottom of output, but per-finding fix lines cite opena2a protect . far earlier — a user pipes/pages the first fix and hits command-not-found before the note. Consider inlining the hint on the FIRST cross-CLI citation instead (relates P2: secure finding-fix recommends opena2a protect but opena2a may not be on PATH #201).

[thebenignhacker]

One more for the batch: npm run lint is broken for any contributor — the script is eslint src --ext .ts but eslint is not in devDependencies at all (sh: eslint: command not found). Either add eslint (+ config) as a devDependency or remove the script.

[thebenignhacker]

Fixed in #289, merged to main as part of the 0.25.1 stack (main is now 0aa368e). Not yet published to npm — 0.25.1 still needs /release-test and a tag push.