fix(cli): report defaulted global parameters in whoami

[TristanSpeakEasy]

Why

whoami reports unchanged global parameter flags as unset even when they have a default value. This hides the configured fallback, including boolean false and numeric 0.

What changed

• Fall back to unchanged global parameter flag values after explicit flags, environment variables and config values, with source default in text and machine output.
• Keep empty strings and missing flags unset. Security credential resolution, masking and request construction are unchanged.
• Add regression coverage for text/JSON output, inherited flags, string/boolean/numeric defaults and source precedence using the existing generic CLI fixture.
• Update CLI documentation and help, regenerate the review CLI, and add a CLI globals changeset.

Testing

• Passed: focused TestWhoamiGlobalDefaults and TestResolveCredentialDefaultPrecedence tests. Default assertions failed before the fix.
• Passed: manual JSON whoami check for false, 0 and an unset optional string.
• Passed: npm run format, make check-template-cli, and git diff --check.
• Passed: primary/review CLI generation, compilation and staticcheck. Review target tests passed on a serial rerun: 545 tests, two skipped. The initial review run conflicted with the primary mock server on the shared port.
• TARGET=primary make test-cli: 1,449 tests, four failures in unchanged configure tests (TestConfigureSkipsOptionalCredentials, TestConfigurePreservesExistingValues, TestConfigureMaskSecretDisplay, TestConfigureCreatesConfigDir). These expect an interactive form but receive the non-interactive "no flags provided" error.
• make lint: blocked in the unchanged permission generator by source-path resolution (./gen.go cannot be made relative to the repository root). Restored its truncated generated manifest; no permission changes are included.
• Not run: the full multi-target matrix or aggregate generator suite, since the production change is confined to the CLI template. Usage/coverage stages were not reached in the failed make test gates.

Public-safety check

• This change contains no credentials, customer documents, private repository URLs, private filesystem paths, or unredacted private logs.
• Title, body, comments, and commit messages name no customers or customer-derived identifiers, private paths or trackers, or workflow provenance, and are understandable without private context (.claude/skills/public-repo-communication/SKILL.md).
• Generated fixtures and review SDK changes are public-safe.
• I reviewed git diff --check.

---

Summary by cubic

Fixes whoami so unchanged global parameter flags with built-in defaults are reported as [default] rather than [unset].

• Defaults now resolve through flag > env var > config file > flag default, including boolean false and numeric 0.
• Empty strings and missing flags remain [unset]; security credential resolution, masking, and request construction are unchanged.
• Adds regression tests for text/JSON output, source precedence, and inherited flags; the tests now reset config and env state so they run in isolation.
• Updates CLI docs and release workflow snapshots to verify the release tag matches the generated CLI version. Includes a changeset.

^{Written for commit eab983d. Summary will update on new commits.}

[cubic-dev-ai]

All reported issues were addressed across 9 files

<sub>Shadow auto-approve: would not auto-approve because issues were found.

Fix all with cubic | Re-trigger cubic</sub>

[TristanSpeakEasy]

Both findings in this review are addressed in 1d8152a:

• Each new whoami/default-precedence subtest now resets process-global config during cleanup.
• The README clarifies that empty or missing flags still fall back to environment and config values.

Primary regeneration, compilation/staticcheck, template checks, and the focused whoami/keyring tests (-shuffle=on -count=5) passed. The full suites and lint were not rerun for this test/documentation-only follow-up; the previously reported four primary configure-test failures and permission-generator lint blocker still apply.

[cubic-dev-ai]

0 issues found across 2 files (changes from recent commits).

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

<sub>Shadow auto-approve: would not auto-approve. Auto-approval blocked by 1 unresolved issue from previous reviews.

Re-trigger cubic</sub>

[cubic-dev-ai]

0 issues found across 1 file (changes from recent commits).

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

<sub>Shadow auto-approve: would auto-approve. Fixes whoami so unchanged global parameter flags with built-in defaults (including false/0) are reported as [default], with regression tests, docs, and generated CLI updates; the change is confined to reporting and test isolation and is clearly beneficial.

Re-trigger cubic</sub>

[AshGodfrey]

whoami and request construction disagree. The new fallback in ResolveCredential reports [default] whenever an unchanged flag has a non-empty string value, which includes the implicit false and 0 of boolean and numeric flags. Request construction in templating.ts only applies the flag default when the schema declares one. So for a required integer path global with no schema default, whoami says [default] 0 while the CLI sends nothing. The PR's own test asserts this wrong output for global-header-param and global-path-param.

Possible ix: emit the default branch per field at generation time only when field.Default is set, for example by threading a hasDefault bool into the resolver call.

FWIW, the tests fake a default by mutating flag.DefValue rather than using a spec default, which is why they could not catch the above.