feat(cli): add selected stream metadata

[ThomasRooney]

Why

A CLI that projects streamed text discards other event fields, including identifiers needed for a later request. A selected metadata field should remain available without changing the streamed stdout payload.

What changed

Add optional output.stream.metadata: {select, label} to declared intent and operation commands. Both fields are required nonempty strings; the selector uses existing singular-path and streaming-schema validation. Labels reject nonprintable characters.

The shared projector retains the latest nonempty string and reports it once on stderr after clean completion and successful stdout termination. Labels and values are safely escaped. The projector ignores missing or invalid metadata in successfully decoded events; normal typed SDK schema and decoding errors remain unchanged. Explicit rendering choices, raw responses, and machine mode suppress the advisory line; interrupted streams and stdout failures also suppress it.

Add neutral fixtures for single-route and dispatched intents, ordinary and promoted operations, parser diagnostics, runtime retention and failure cases. Keep the new fixtures in CLI-only overlays, with an optional target overlay hook for review generation. Update the CLI documentation, generated review SDK, and changeset.

The shared fixtures caused unrelated SDK golden changes and exposed an existing Python return-annotation mismatch for SSE-only responses. CLI overlays keep this target-specific coverage out of other SDK inputs.

Testing

• The metadata regression failed before implementation because the manifest decoder rejected metadata.
• go test ./internal/extensions -count=1 passed, including metadata validation, open-schema warnings, and escaped-pointer lowering.
• TARGET=review make test-cli passed after fixture isolation: 609 tests, 2 skipped, plus usage checks.
• TARGET=primary make test-cli passed: 1,714 tests, zero failures, exit 0. After moving the primary fixture into the CLI overlay, the assembled spec was semantically identical and regenerated jq and metadata tests passed.
• Generated-command checks covered both dispatch routes, ordinary and promoted operations, output-mode suppression, retention, escaping, failed streams, and cancellation. Typed schema-invalid metadata preserved SDK errors and emitted no footer.
• Python review generation and compilation passed, including mypy, pyright, and pylint. The shared review spec matches the base revision byte for byte; no non-CLI SDK goldens change.
• make lint, make check-template-cli, npm run format, and go generate ./... passed. Lint used the CI-pinned golangci-lint v2.11.2 built with Go 1.26.8.
• Source whitespace checks pass with only zSDKs/sdk-cli/.speakeasy/logs/naming.log excluded. That generated file retains canonical trailing whitespace and remains included in exact regeneration checks.

Public-safety check

• This change contains no credentials, customer documents, private repository URLs, private filesystem paths, or unredacted private logs.
• Title, body, comments, and commit messages name no customers or customer-derived identifiers, private paths or trackers, or workflow provenance, and are understandable without private context (.claude/skills/public-repo-communication/SKILL.md).
• Generated fixtures and review SDK changes are public-safe.
• I reviewed git diff --check; the sole exception is canonical trailing whitespace in the generated CLI naming log, described above.

[cubic-dev-ai]

All reported issues were addressed across 35 files

<sub>Shadow auto-approve: would not auto-approve because issues were found.

View guided diff | Turn on auto-fix | Re-trigger cubic</sub>

[cubic-dev-ai]

0 issues found across 11 files (changes from recent commits).

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

<sub>Shadow auto-approve: would auto-approve. Adds optional output.stream.metadata to CLI generation, reporting a selected field on stderr after clean completion, with validation, templates, and CLI-target tests/docs. Bounded and optional; dismissed finding concerns schema-invalid events whose failure behavior is documented and accepted.

View guided diff | Turn on auto-fix | Re-trigger cubic</sub>

[cubic-dev-ai]

0 issues found across 1 file (changes from recent commits).

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

<sub>Shadow auto-approve: would auto-approve. Adds optional CLI metadata reporting on stderr after successful generation, with validation and regression coverage.

View guided diff | Turn on auto-fix | Re-trigger cubic</sub>