cmd: CLI integration tests + gate-refusal coverage (M1)

cmd/incredigo 4.3% -> 34.5%. Extract newRootCmd() as a testability seam so tests
drive the real wired CLI (persistent flags + every subcommand) via SetArgs.

main_test.go: a runCLI harness that captures os.Stdout/os.Stderr around Execute,
plus a fake gopass on PATH + fixture HOME so no command touches the user's real
store or host dotfiles (discovery isolated to --source file). Covers the safety-
critical contracts: rotate --execute refused without INCREDIGO_ALLOW_EXECUTE=1;
backup gate aborts BEFORE any driver runs when the snapshot fails; empty
passphrase rejected with no sealed content left behind; export refuses to
overwrite; unknown sealer rejected. Plus scan/status/worklist happy paths,
migrate --dedupe, and an export -> import round-trip proving byte-exact restore
with no plaintext in the sealed bundle.

discover: add ClearPaths() to reset the file scanner's process-global --path
targets between CLI invocations (a test-binary need; the one-shot CLI never hits
the stale-target accumulation).

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

cmd/incredigo/main.go

@@ -43,6 +43,18 @@ var (
 )
 
 func main() {
+	if err := newRootCmd().Execute(); err != nil {
+		fmt.Fprintln(os.Stderr, "incredigo:", err)
+		os.Exit(1)
+	}
+}
+
+// newRootCmd builds the fully-wired root command. Extracted from main so tests can
+// drive the real CLI (persistent flags + every subcommand) with SetArgs/Execute.
+// Because the flag vars are package-level and pflag writes each default into its
+// bound variable at registration, constructing a fresh root per call also resets
+// flag state between test invocations.
+func newRootCmd() *cobra.Command {
 	root := &cobra.Command{
 		Use:           "incredigo",
 		Short:         "Local-first, encrypted, RAM-only credential custody",
@@ -55,11 +67,7 @@ func main() {
 	root.PersistentFlags().StringVar(&flagSealer, "sealer", "age", "backup sealer: age (default, authenticated), hmac (authenticated, openssl-only), or openssl (unauthenticated)")
 
 	root.AddCommand(scanCmd(), migrateCmd(), statusCmd(), exportCmd(), importCmd(), rotateCmd(), worklistCmd(), guideCmd(), passwordsCmd())
-
-	if err := root.Execute(); err != nil {
-		fmt.Fprintln(os.Stderr, "incredigo:", err)
-		os.Exit(1)
-	}
+	return root
 }
 
 // applyPaths registers any --path targets with the file scanner and, when an