draft: One Command, No Copied Tokens (Cloud pairing)

[abrichr]

Auto-drafted by the daily pipeline on 2026-07-19 and stranded: the run authored the post and pushed the branch, but could not open this PR (ADMIN_TOKEN lacked pull_requests: write). Fixed in #45; opening the backlog by hand.

Merging does not publish this post. The front matter is draft: true and deploy.yml builds with hugo --minify, without --buildDrafts. The file lands on main unpublished. Flip draft: false in a later PR to publish.

The daily scan is paused while any auto-draft/* PR is open, by design, so drafts cannot pile up. Merging or closing all three resumes it. See NEEDS_YOU B10.

[abrichr]

Closing this one, not deleting the branch.

lint_post_substance.py --strict puts it below the floor:

FAIL: thin: 776 words (floor 850)
WARN: no visible thesis/takeaway

There's a real idea buried in it: the CLI is deliberately thin so the safety properties (staged credential storage, idempotent confirm, promotion only on a definitive answer) live in an independently tested core rather than in installer scripts. The draft never says that's the point, so it reads as a recount of three PRs. It also admits it never re-ran the test counts it cites.

The branch stays on origin and this closed PR keeps it reachable, so nothing is lost. Reopen if you want to rewrite it around that idea. The source PRs and the angle are recorded in docs/POST_BACKLOG.md.

A closed PR is also the resting state the guard from #45 was built to tolerate, so this branch no longer blocks the daily scan.