feat(profile): add read-only profile inventory

[christso]

Summary

allagents profile list now provides a deterministic, read-only inventory of every declared profile and every installed profile whose declaration is missing. Human and JSON output expose profile state, clients, launcher paths, and PATH diagnostics without opening a selector or changing user-owned files or native state; profile status [name] remains the detailed single-profile diagnostic.

The command reuses the existing profile status reconciliation and reports incomplete inspections with a nonzero exit while preserving the full inventory payload. Empty or invalid profile directories are excluded, and the automatic update check is disabled through command metadata so a human inventory run stays read-only.

Validation

• bun test tests/unit/cli/profile-command.test.ts tests/unit/core/profile/manager.test.ts tests/unit/cli/agent-help.test.ts tests/unit/cli/update-check.test.ts tests/e2e/profile-list-read-only.test.ts tests/e2e/cli-enriched-help.test.ts
  • 172 passed, 1 skipped, 0 failed; 469 assertions across 6 files.
• bun run typecheck
  • Passed with no diagnostics.
• bun run lint
  • Checked 119 source files; no fixes required.
• bun run build
  • Bundled 546 modules successfully into dist/index.js.
• git diff --check origin/main
  • Passed with no whitespace errors.

Built-CLI smoke used a temporary workspace and HOME containing one declared work profile with a Pi launcher and one installed declaration-missing orphan profile. The smoke captured the complete temporary tree before running:

HOME="$HOME_DIR" ALLAGENTS_TEST_HOME="$HOME_DIR" PATH=/usr/bin:/bin node "$REPO/dist/index.js" profile list
HOME="$HOME_DIR" ALLAGENTS_TEST_HOME="$HOME_DIR" PATH=/usr/bin:/bin node "$REPO/dist/index.js" --json profile list

Both commands exited 0 with empty stderr. Human output reported orphan as declaration-missing, work as declared but missing, and the absolute work launcher path as not on PATH. JSON returned success: true, command: "profile list", the same two profiles, structured launcher fields, and total: 2. The before/after filesystem snapshots were identical.

Post-Deploy Monitoring & Validation

No additional operational monitoring required: this is a local read-only CLI surface with no service, persistence migration, or remote rollout. Release validation is the built-CLI smoke above; any created file, selector prompt, missing orphaned profile, or malformed JSON envelope is a regression and should trigger a revert.

---