refactor(cli): add stderr diagnostics logger + oxlint guard

[jrusso1020]

Supersedes #2523 (auto-closed when its stack base #2522 merged + the base branch was deleted). Same reviewed change, rebased onto main; Via approved the content on #2523.

What

Introduces a small CLI diagnostics logger (packages/cli/src/ui/diagnostics.ts, diag) that routes notices/warnings to stderr, routes the diagnostic sites fixed in #2522 through it, and adds a scoped oxlint no-console guard so pipeline/diagnostic dirs can't regress by writing to stdout again.

Why

#2522 fixed five stdout-pollution bugs with raw console.error/console.warn. This is the "better way" follow-up: a single chokepoint for CLI diagnostics (mirroring the producer's ProducerLogger contract, but without [LEVEL] prefixes so user notices keep their formatting), plus lint enforcement so the class of bug can't creep back.

How

• diag logger — notice (→ console.error) and warn (→ console.warn), both stderr. stdout stays reserved for command payloads (--json) and primary human output.
• Routed through diag: the telemetry first-run disclosure, the capture font-metadata notes, and the skills install/mirror progress. The skills non-strict skip-after-error uses diag.warn (semantically a warning), everything else diag.notice.
• oxlint guard: no-console (allow error/warn) scoped to capture/, registry/, templates/, telemetry/ (excluding tests + the interactive telemetry/feedback.ts). Diagnostics-only dirs, already clean, so the guard passes today and blocks future stdout diagnostics there. Verified it fires on a stray console.log in a guarded dir and leaves command bodies untouched.

Scope note

Guard is deliberately not repo-wide: other CLI shared dirs (ui/banner, auth/oauth, server/portUtils, utils/variables, telemetry/feedback) legitimately print human output to stdout, so a blanket rule false-positives (needs an output()-helper migration first). commands/ (skills/compositions fixes) and the producer package (htmlCompiler fix) are also outside guard scope — tracked follow-up.

Test plan

• bunx oxlint packages/cli/src → 0 errors; guard fires on injected console.log in a guarded dir, not in command bodies.

• bunx vitest run src/commands/skills.test.ts src/commands/compositions.test.ts → 41 pass.

• oxfmt clean.

• Unit tests added/updated (existing suites cover the routed paths)

• Documentation updated (if applicable)

[vanceingalls]

Re-stamp on rebase of #2523 (previously approved at 6f78fff2).

Verified

• File-list equivalence with #2523: same 5 files, same additions/deletions per file (.oxlintrc.json +14/-0, capture/index.ts +6/-5, commands/skills.ts +11/-9, telemetry/client.ts +11/-10, ui/diagnostics.ts +23/-0 added). Total +65/-24 identical.
• Byte-identity with #2523 final head (d4a82b1): all 5 files diff clean at #2551 head 9786c10. Clean rebase carry-forward; no sibling drift absorbed.
• R1 nits addressed (delta from my approval SHA 6f78fff2 → 9786c10):
  • commands/skills.ts:266 — strict=false catch now diag.warn(...), was diag.notice(...). Semantic downgrade nit resolved.
  • PR body — diag.error mention dropped; body now matches the two-method surface (notice / warn). Body-drift nit resolved.
• Base: main at 9786c10. mergeable: MERGEABLE, mergeStateStatus: BLOCKED on review-required only (no prior review on #2551 itself).
• CI: all completed required checks passing (Build, Typecheck, Lint, Format, Fallow, Producer/SDK/Studio suites, npx shim ×3, preview parity, runtime contract, semantic PR title). A handful still pending (Test, Windows tests, CLI smoke required, global-install smoke, javascript-typescript CodeQL, Windows render) — none failing.

Content approval carries forward with the two R1 nits landed. LGTM.

Verdict: APPROVE
Reasoning: Rebase-clean carry of previously-approved #2523 content, plus the diag.warn semantic fix and PR-body cleanup I asked for at R1. No new drift.

— Via