feat(ihatepdf-cv): add ihatePDF CLI - #1785

$ ihatepdf-cv-pp-cli --help
Ihatepdf Cv CLI — Private PDF operations for agents, scripts, and offline pipelines.

Highlights (not in the official API docs):
  • privacy-scan   Find content and metadata risks before a PDF leaves your machine.
  • fingerprint   Record SHA-256, SHA-1, and MD5 hashes for inputs and outputs.
  • inspect   Expose PDF structure, metadata, and hashes as compact JSON.
  • search   Search extracted text across local PDFs and return matching snippets.
  • catalog index   Index PDF paths, hashes, page counts, and extracted text in a local SQLite catalog.

Agent mode: add --agent to any command for JSON output + non-interactive mode.
Health check: run 'ihatepdf-cv-pp-cli doctor' to verify auth and connectivity.
See README.md or the bundled SKILL.md for recipes.

Usage:
  ihatepdf-cv-pp-cli [command]

Available Commands:
  agent-context  Emit structured JSON describing this CLI for agents
  api            Browse all API endpoints by interface name
  catalog        Index and search a local PDF catalog without uploading documents.
  completion     Generate the autocompletion script for the specified shell
  doctor         Check CLI health
  encrypt        Password-protect a PDF locally with AES encryption.
  export         Export a local PDF inspection manifest with pages, metadata, and hashes.
  extract-text   Extract readable PDF text to stdout or a file.
  feedback       Record feedback about this CLI (local by default; upstream opt-in)
  fingerprint    Fingerprint local files; returns labeled SHA-256, SHA-1, and MD5 hashes.
  help           Help about any command
  images-to-pdf  Convert JPG and PNG images to a local PDF.
  import         Import local PDFs into the searchable catalog without uploading them.
  inspect        Inspect local PDF structure and metadata; returns page count, hints, and hashes.
  learnings      Inspect or forget the local search_learnings table
  merge          Combine PDFs in explicit order without uploading them.
  merge-pdf      Check the ihatepdf.cv website
  playbook       Inspect or amend stored CLI playbooks
  privacy-scan   Scan local PDF content and metadata; returns classified risk findings and hints.
  profile        Named sets of flags saved for reuse
  recall         Check prior learnings for a query before running discovery (LLM-fired, pre-discovery)
  rotate         Rotate selected PDF pages locally.
  search         Search extracted text across local PDFs; returns matching snippets and counts.
  split          Split a PDF into deterministic page-group files.
  tail           Show the last extracted text lines from a local PDF.
  teach          Record a query -> resource mapping for future recall (LLM-fired, silent)
  teach-lookup   Install a manual entity-lookup row (kind, canonical, value)
  teach-pattern  Install a manual generalization pattern (query_template, resource_template, entity_kind)
  teach-playbook Record a CLI playbook + free-text notes for a query family
  text-to-pdf    Render plain text or Markdown into a local PDF.
  version        Print version
  which          Find the command that implements a capability
  workflow       Compound workflows that combine multiple API operations

Flags:
      --agent                   Set agent-friendly output defaults (--json --compact --no-input --no-color)
      --audit-dir string        Aggregate the receipt and index under this audit directory
      --client-profile string   Select the tenant-gated client profile (env: PRINTING_PRESS_CLIENT_PROFILE)
      --compact                 Return only key fields (id, name, status, timestamps) for minimal token usage
      --config string           Config file path
      --csv                     Output as CSV (table and array responses)
      --data-source string      Data source for read commands: auto (live with local fallback), live (API only), local (synced data only) (default "auto")
      --deliver string          Route output to a sink: stdout (default), file:<path>, webhook:<url>
      --dry-run                 Show request without sending
  -h, --help                    help for ihatepdf-cv-pp-cli
      --home string             Root directory for config, data, state, and cache files
      --human-friendly          Enable colored output and rich formatting
      --insecure                Skip TLS certificate verification
      --json                    Output as JSON
      --no-cache                Bypass response cache
      --no-color                Disable colored output
      --no-input                Disable all interactive prompts (for CI/agents)
      --no-learn                Disable the teach/recall learning loop for this invocation
      --plain                   Output as plain tab-separated text
      --profile string          Apply values from a saved run profile; this does not select a client (see 'ihatepdf-cv-pp-cli profile list')
      --quiet                   Bare output, one value per line
      --rate-limit float        Max requests per second (0 to disable, default 2 for sniffed APIs) (default 2)
      --receipt                 Write an atomic private run receipt
      --receipt-file string     Override the run receipt destination
      --select string           Comma-separated fields to include in output
      --timeout duration        Request timeout (default 1m0s)
  -v, --version                 version for ihatepdf-cv-pp-cli
      --yes                     Skip confirmation prompts (explicit confirmation for scripts)

Use "ihatepdf-cv-pp-cli [command] --help" for more information about a command.

\`\`\`

### Novel Commands

| Command | Name | Description |
|---------|------|-------------|
| `privacy-scan` | Privacy audit before sharing | Find content and metadata risks before a PDF leaves your machine. |
| `fingerprint` | Integrity trail | Record SHA-256, SHA-1, and MD5 hashes for inputs and outputs. |
| `inspect` | Agent-native inspection | Expose PDF structure, metadata, and hashes as compact JSON. |
| `search` | Local PDF text search | Search extracted text across local PDFs and return matching snippets. |
| `catalog index` | Local PDF catalog | Index PDF paths, hashes, page counts, and extracted text in a local SQLite catalog. |

### What This CLI Does

This CLI carries the website's no-upload promise into scripts and agent workflows. It provides local PDF inspection, privacy scanning, hashing, conversion, cataloging, and safe output handling with structured JSON output.

Browser-only redaction UI, workflow presets, OCR/model downloads, signatures, camera capture, P2P sharing, and collaboration remain intentionally outside the CLI boundary.

### Manuscripts

- [20260822-095304-feat-ihatepdf-cv-pp-cli-absorb-manifest.md](https://github.com/mvanhorn/printing-press-library/blob/1e0246ba8843b67a4bc60cd8ad595d06010aa1db/library/productivity/ihatepdf-cv/.manuscripts/20260822-095304-45ca41a1/research/20260822-095304-feat-ihatepdf-cv-pp-cli-absorb-manifest.md)
- [20260822-095304-feat-ihatepdf-cv-pp-cli-brief.md](https://github.com/mvanhorn/printing-press-library/blob/1e0246ba8843b67a4bc60cd8ad595d06010aa1db/library/productivity/ihatepdf-cv/.manuscripts/20260822-095304-45ca41a1/research/20260822-095304-feat-ihatepdf-cv-pp-cli-brief.md)
- [ihatepdf-cv.yaml](https://github.com/mvanhorn/printing-press-library/blob/1e0246ba8843b67a4bc60cd8ad595d06010aa1db/library/productivity/ihatepdf-cv/.manuscripts/20260822-095304-45ca41a1/research/ihatepdf-cv.yaml)
- [phase5-acceptance.json](https://github.com/mvanhorn/printing-press-library/blob/1e0246ba8843b67a4bc60cd8ad595d06010aa1db/library/productivity/ihatepdf-cv/.manuscripts/20260822-095304-45ca41a1/proofs/phase5-acceptance.json)
- [publish-live-gate.json](https://github.com/mvanhorn/printing-press-library/blob/1e0246ba8843b67a4bc60cd8ad595d06010aa1db/library/productivity/ihatepdf-cv/.manuscripts/20260822-095304-45ca41a1/proofs/publish-live-gate.json)
- [removal-validation.md](https://github.com/mvanhorn/printing-press-library/blob/1e0246ba8843b67a4bc60cd8ad595d06010aa1db/library/productivity/ihatepdf-cv/.manuscripts/20260822-095304-45ca41a1/proofs/removal-validation.md)

### Validation Results

| Check | Result |
|-------|--------|
| Manifest | PASS |
| Phase 5 | PASS |
| go mod tidy | PASS |
| govulncheck (this CLI only, reachable findings) | PASS |
| go vet | PASS |
| go build | PASS |
| --help | PASS |
| --version | PASS |
| Verify | 38/38 PASS |
| Tools audit | 0 findings |
| PII audit | 0 findings |
| Manuscripts | PRESENT |

### Publish Live Gate

Full live dogfood reran at publish time and passed: 106/106 counted checks, with no hollow novel-feature coverage.

### Scope Note

The browser-only `redact` and `workflow run` commands were removed before packaging, along with their registrations, feature metadata, docs, tests, and fixtures. The remaining `workflow status` catalog command is retained.