fix: correct exit codes, unknown subcommands, and table overflow

[patramsey]

An audit of the CLI surface — how the binary presents itself, rather than what
it asks the API for — turned up nine defects. All nine are fixed here.

Breaks scripted use

A mistyped subcommand succeeded. Cobra's legacyArgs only rejects unknown
commands on the root command; for a parent that itself has a parent it
returns nil, so cobra fell through to "not runnable", printed help, and
returned no error.

$ namecom domain regsiter example.com
<prints domain help>
$ echo $?
0

namecom domain regsiter foo.com && deploy deployed. Every group now goes
through cmdutil.GroupCmd, which rejects an unknown subcommand as a usage
error and reuses cobra's suggestion list. Invoking a group bare still prints
help and exits 0.

Invocation mistakes exited 1 instead of the documented 2. Two causes: the
validators in cmd/cmdutil/validate.go returned bare fmt.Errorf values, and
cobra checks required flags inside execute() — after SetFlagErrorFunc has
had its chance, with no hook of its own.

invocation	before	after
dns create example.com --type ZZZ --answer 1.2.3.4	1	2
dns create example.com (required flags missing)	1	2
dns list example.com --badflag	2	2
domain get (arg missing)	2	2

A script watching for exit 1 could not tell a typo from a server error.
Validators now build UsageError directly; cobra's own messages are
classified in one documented place, asserted by a test that fails loudly if an
upgrade rewords them.

--dry-run was silently ignored on reads. It promised to "print the API
request that would be sent without executing it", but only the 28 write paths
consult IsDryRun — namecom domain list --dry-run made a live authenticated
call and returned real account data. Rather than change what 38 read commands
do, the flag now describes what it actually does.

Terminal output

Tables overflowed the terminal. They rendered at natural width regardless
of it — domain list 113 columns, order list 99, dns list 87 — so in an
80-column pane the rounded borders wrapped into fragments. Trailing columns
are now dropped until the table fits, since callers order columns
most- to least-important, and a footer names what went rather than letting it
vanish:

╭───────────────────────────────────────────────────┬──────────────────────────╮
│ DOMAIN                                            │ EXPIRES                  │
├───────────────────────────────────────────────────┼──────────────────────────┤
│ loadtest-ff7fb52b-b51b-46c8-b254-6a557f053321.com │ 2027-03-01 (in 6 months) │
│ beers.army                                        │ 2034-03-01 (in 8 years)  │
╰───────────────────────────────────────────────────┴──────────────────────────╯
3 columns hidden (auto-renew, locked, privacy) — widen the terminal, pass --wide, or use -o json

The new --wide opts out. A pipe has no width to fit and keeps every column,
so scripts reading table output are unaffected.

Relative dates only spoke days. A domain paid through 2034 read in 2750 days. Days stay exact inside a quarter, where a renewal decision is actually
pending; past that the unit widens to months, then years.

Help and docs

• Examples: moved from below the flag tables and the "see all global
  options" footer to directly under the usage line.
• Command groups showed namecom domain [flags], an invocation that does
  nothing; they now show namecom domain <command>.
• dns create --type omitted CAA, which the validator has always accepted.
• Non-string flag defaults print unquoted — default 300, not default "300".
• CLAUDE.md's command tree had drifted: no config, contact, status,
  open, or version, and vanity/ where the command is vanity-ns.

Tests

• TestEveryGroupRejectsUnknownSubcommands walks the real command tree, so a
  group added later without GroupCmd fails rather than silently regressing.
• TestClassifyCobraUsage pins the cobra message strings the exit-code
  mapping depends on.
• TestTableFitsTerminalWidth covers dropping, --wide, and the unconstrained
  pipe case.
• TestRelativeTimeWidensUnit pins the unit thresholds.

make test, make lint, and make build all pass.

[codecov]

Codecov Report

❌ Patch coverage is 95.83333% with 7 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
internal/output/output.go	95.1%	2 Missing and 1 partial ⚠️
cmd/help.go	86.6%	1 Missing and 1 partial ⚠️
cmd/root.go	50.0%	2 Missing ⚠️

📢 Thoughts on this report? Let us know!