docs(minimal): hide --network and --ingress from the CLI surface - #999

… unhide note

Two corrections to the `min login` hide, no change in behaviour.

`#[clap(hide = true)]` becomes `#[command(hide = true)]`. The three other
hidden subcommands in this enum — `Proxy`, `Spin`, `CompleteSessionStr` —
all use the `#[command(...)]` spelling. #999 used `#[clap(...)]`, but that
was on struct fields, where the neighbouring attribute is `#[arg(...)]`;
inside `Command` the matching form is `#[command(...)]`.

The unhide instruction said "restore the section in
docs/reference/cli-min.md". There is no such section to restore — it was
dropped in bfaddc4 — so a future maintainer would go looking for
something that does not exist. It now says to document the command there
when unhiding.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* docs(minimal): hide `min login` from the CLI surface

`min login` cannot work against an installed daemon. It issues an mTLS
client certificate through minimald's `IssueClientCert` RPC, which exists
only under minimald's off-by-default `networking-proxy` feature, and the
release jobs build minimald with no `--features` at all. A shipped daemon
answers that RPC with "minimald was built without the networking-proxy
feature" and never binds the :7655 proxy listener, so the command is
usable only from a dev checkout, whose guest initramfs the justfile does
build with the feature.

Hidden, not removed. The command still parses and still dispatches;
`LoginArgs`, the dispatch arm, and `cmd_login` are untouched, so nothing
running it today changes behaviour — this is only about what we put in
front of someone reading `--help`. docs/reference/cli-min.md already
carries no `login` section (dropped in bfaddc4), so unlike #999 there is
no reference row to remove.

The doc comment records the unhide condition so this does not become
permanent by forgetting: unhide, and restore the reference section, once
shipped minimald builds the proxy in.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* docs(minimal): match the hide attribute to its neighbours and fix the unhide note

Two corrections to the `min login` hide, no change in behaviour.

`#[clap(hide = true)]` becomes `#[command(hide = true)]`. The three other
hidden subcommands in this enum — `Proxy`, `Spin`, `CompleteSessionStr` —
all use the `#[command(...)]` spelling. #999 used `#[clap(...)]`, but that
was on struct fields, where the neighbouring attribute is `#[arg(...)]`;
inside `Command` the matching form is `#[command(...)]`.

The unhide instruction said "restore the section in
docs/reference/cli-min.md". There is no such section to restore — it was
dropped in bfaddc4 — so a future maintainer would go looking for
something that does not exist. It now says to document the command there
when unhiding.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* docs(minimal): drop the hide rationale from the source comment

Keeps the `#[command(hide = true)]` attribute and removes the eleven-line
doc-comment paragraph that explained it, leaving `min login`'s pre-existing
help text exactly as it was on main. The diff against main is now a single
added line.

The paragraph was reaching the wrong audience. `hide` only removes a
subcommand from the parent listing, so `min login --help` still rendered
the whole thing — maintainer-facing build-system reasoning, shown to the
one user who managed to find the command. Recording it here and in the pull
request keeps it with the change without putting it in front of that user.

Why the command is hidden, verified against this tree:

  - Issuance rides minimald's `IssueClientCert` RPC, which is
    `#[cfg(feature = "networking-proxy")]` (crates/minimald/src/rpc.rs).
  - `networking-proxy` is off by default; crates/minimald/Cargo.toml
    declares no `default` feature set.
  - .github/workflows/release.yml builds `--package minimald` with no
    `--features` at all, for both linux-amd64 and linux-arm64, and
    build-release-initramfs repacks those same binaries by setting
    MINIMALD_BIN, which makes scripts/build-initramfs.sh ignore FEATURES.
    So the guest daemon in a shipped microVM lacks the feature too.

A shipped daemon therefore answers the RPC with "minimald was built without
the networking-proxy feature; client certificate issuance is unavailable"
and never binds the :7655 proxy listener. The command only works from a dev
checkout, where the justfile passes `features := "networking-proxy"` into
the guest initramfs.

Unhide once shipped minimald builds the proxy in, and document `login` in
docs/reference/cli-min.md at that point — the reference carries no `login`
section today, having dropped it in bfaddc4.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>