chore(cli-registry): clean up dead code and stale claims left after #380

Addresses the "left as they are"/"worth knowing" items Ark0N named when
merging #380 (the CLI-catalogue-driven install.sh + Docker agent image
PR), none of which were correctness-blocking but all of which were real:

- Removed install.sh's dead _cli_index/check_cli/get_cli_path helpers:
  the catalogue-driven menu and hints stopped calling them and nothing
  else ever did.
- The generator no longer emits CLI_KIND/CLI_NPM, two bash arrays
  install.sh never read (the .mjs/docker-hosts.ts producers already
  read the JSON catalogue's kind/npmPackage fields directly, so only
  the bash copies were dead).
- detect_all_clis now skips a disabled entry's probe entirely instead
  of running it and filtering the result downstream. No stock entry
  ships disabled today, so this closes a latent inefficiency before it
  is a latent bug rather than fixing an observed one.
- The install hint for a launcherProfile entry (DeepSeek today) now
  explains in one line why it's a docs link and not a command: its own
  docs page documents `npm install -g @deepseek-ai/dsh`, which installs
  the launcher only and can't drive a pane, the exact trap the menu
  already avoids by withholding the command. Driven by a new generated
  CLI_LAUNCHER_ONLY array (from discovery.launcherProfile), not an id
  check, so any future launcherProfile entry gets the same caveat free.
- Corrected the non-interactive-default comment: on a wget-only host,
  Claude's curl one-liner is filtered out of the offered list first, so
  the default becomes whichever npm-based entry sorts earliest instead
  (Codex today), not always Claude. Behaviour is unchanged — it was
  already printed, never silent — only the comment overclaimed.

Tests: extended test/install-sh-invariants.test.ts with a positive
guard for the new array and the trimmed array list, a negative guard
that CLI_KIND/CLI_NPM/the three dead helpers cannot come back, and two
real-bash tests (driven the same way the existing skip-menu tests are)
proving a disabled entry is genuinely never probed rather than merely
filtered after the fact.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011WzDjJnbK7zug8iQWnCc9z

test/install-sh-invariants.test.ts

@@ -48,13 +48,12 @@ describe('install.sh generated-catalogue block', () => {
     );
   });
 
-  it('declares every array the detection code indexes', () => {
+  it('declares every array install.sh actually reads', () => {
     for (const name of [
       'CLI_IDS',
       'CLI_LABELS',
       'CLI_ENABLED',
-      'CLI_KIND',
-      'CLI_NPM',
+      'CLI_LAUNCHER_ONLY',
       'CLI_DOCS',
       'CLI_CMD_LINUX',
       'CLI_CMD_DARWIN',
@@ -69,6 +68,17 @@ describe('install.sh generated-catalogue block', () => {
     }
   });
 
+  it('declares no array install.sh never reads', () => {
+    // CLI_KIND and CLI_NPM were generated and read by nothing (the .mjs/docker-hosts.ts
+    // producers read the JSON's `kind`/`npmPackage` fields directly; only these two bash
+    // arrays were dead). A generated-but-unread array is a maintenance trap the generator
+    // itself cannot warn about — it has no reader to check against — so this pins the
+    // opposite of the test above: naming what must NOT come back rather than what must.
+    for (const name of ['CLI_KIND', 'CLI_NPM']) {
+      expect(new RegExp(`^${name}=\\(`, 'm').test(SOURCE), `${name} is declared but nothing reads it`).toBe(false);
+    }
+  });
+
   it('keeps no hand-written per-CLI detection behind', () => {
     // The nine `*_SEARCH_PATHS` arrays and eighteen `check_<cli>`/`get_<cli>_path` pairs are
     // what this change removes. One left behind would be a second source of truth that the
@@ -93,6 +103,16 @@ describe('install.sh generated-catalogue block', () => {
       []
     );
   });
+
+  it('keeps no dead generic-lookup helpers behind', () => {
+    // _cli_index/check_cli/get_cli_path were the ungenericized precursor to the per-CLI
+    // helpers above: same shape, one level of indirection, called from nowhere once the
+    // catalogue-driven menu and hints stopped needing a lookup-by-id. Unlike the per-CLI
+    // pairs these are exact names, not derived from the catalogue.
+    for (const fn of ['_cli_index()', 'check_cli()', 'get_cli_path()']) {
+      expect(CODE.includes(fn), `${fn} should have been removed as dead code`).toBe(false);
+    }
+  });
 });
 
 describe('install.sh trust boundary', () => {
@@ -245,3 +265,42 @@ describe('install.sh AI CLI install menu', () => {
     expect(run.status).toBe(1);
   });
 });
+
+describe('install.sh detect_all_clis and a disabled entry', () => {
+  // No stock entry ships disabled today, so this is characterization rather than a regression
+  // pin on real data: it drives the real function in a real bash with entry 0 fabricated
+  // disabled, and points its binary at `bash` — guaranteed resolvable via `command -v` — to
+  // prove the entry is genuinely never PROBED (CLI_FOUND_PATH stays empty) rather than merely
+  // filtered out downstream by every consumer's own `CLI_ENABLED` check.
+  function driveDetect(disableEntry0: boolean) {
+    const driver = `
+      set -euo pipefail
+      export CODEMAN_INSTALL_SH_LIB=1
+      . "$1"
+      k=0; while [[ $k -lt \${#CLI_ALL_BINS[@]} ]]; do CLI_ALL_BINS[$k]="codeman-test-no-such-bin-$k"; k=$((k + 1)); done
+      k=0; while [[ $k -lt \${#CLI_ALL_PATHS[@]} ]]; do CLI_ALL_PATHS[$k]="/nonexistent/codeman-test/$k"; k=$((k + 1)); done
+      # Point entry 0's first declared binary at something that WILL resolve, so a probe that
+      # runs at all finds it.
+      CLI_ALL_BINS[\${CLI_BIN_OFF[0]}]="bash"
+      ${disableEntry0 ? 'CLI_ENABLED[0]="0"' : ''}
+      CLI_DETECT_DONE=""
+      detect_all_clis
+      echo "path0=[\${CLI_FOUND_PATH[0]}]"
+      echo "found=$CLI_FOUND_COUNT"
+    `;
+    const result = spawnSync('bash', ['-c', driver, 'bash', INSTALL_SH], { encoding: 'utf-8', timeout: 30_000 });
+    return { status: result.status, stdout: result.stdout ?? '', stderr: result.stderr ?? '' };
+  }
+
+  it('probes an enabled entry (control case)', () => {
+    const run = driveDetect(false);
+    expect(run.stdout, run.stderr).not.toContain('path0=[]');
+    expect(run.stdout).toContain('found=1');
+  });
+
+  it('never probes a disabled entry', () => {
+    const run = driveDetect(true);
+    expect(run.stdout, run.stderr).toContain('path0=[]');
+    expect(run.stdout).toContain('found=0');
+  });
+});