feat: print the CLI surface on demand

[matheusPavaneli]

What

wb surface prints every group, action and flag, walked from build_parser().

A session composing an unfamiliar call had to infer flags from prose in a SKILL.md, and prose is where a flag that never existed comes from — wb pr check --key ABC-1 was written that way and refused by argparse. test_plugin.py already holds every command to being named somewhere a session reads; naming is not knowing what it takes.

It reports what the invented calls get wrong: which arguments are positional, which are required, which take no value, and the closed set a choice flag allows.

$ wb surface pr
wb pr context   branch, commits, plan summary, verification verdict
  key   [positional; required]
  --base <value>
  --target <value>
wb pr check   reject filler, empty sections and placeholders in a draft
  --file <value>   [required]
  --shape <value>   [one of: trivial, small, large]

This is the schema MCP publishes for every tool in the system prompt of every session, used or not. Here it is complete and costs nothing until something asks — the same trade wb route made by being a command rather than an eleventh skill. No SKILL.md names it; the README does.

Walked rather than kept by hand, because a hand-kept list of flags is a second description of the CLI, and a second description is the thing that drifts.

Verification

python -m unittest discover -s tests -q     641 tests, OK (skipped=4)

7 new tests, including the one that matters: wb surface pr --json names exactly --file and --shape, and asserts --key is absent.

One regression is covered because it happened during the work: the positional was first named group, which is the dest the top-level parser already owns, so wb surface task overwrote it and dispatched to wb task instead. Renamed to of with metavar GROUP, with a test that naming a group prints it rather than running it.

Risk and rollback

New command, nothing existing changed. contract.VERSIONS gains surface: 1. Revert the commit to remove it.