wheels-packages Phase 3 — CLI commands (install/list/update/remove)

[bpamiri]

Phase 3 of #2243.

Ship the CLI surface for consuming the wheels-packages registry.

Scope

• wheels packages list — all packages in registry
• wheels packages search <query> — name/description/tag match
• wheels packages show <name> — details, versions, homepage
• wheels packages install <name> — latest compat version
• wheels packages install <name>@<version> — pin a version
• wheels packages update <name> — bump to latest compat (requires confirmation)
• wheels packages update --all — bump all (requires --yes)
• wheels packages remove <name> — rm -rf vendor/
• wheels packages registry refresh — bust 24h manifest cache
• wheels packages registry info — show registry URL, last refresh, cache location
• Reuse SemVer matcher from PackageLoader (shipped in fix(packages): PackageLoader accepts wheelsVersion constraint but never validates it #2231)
• Explicit-only update policy — no auto-pull on reload

Acceptance

• A user on Wheels 4.1 can run wheels packages install wheels-sentry and have it appear under vendor/ after reload, with the tarball sha256 verified against the registry's manifest.

[bpamiri]

Closing — scope is complete and merged.

Scope verification

Scope item	Delivered in
wheels packages list	#2276 · PackagesMainCli.list()
wheels packages search <query>	#2276 · PackagesMainCli.search()
wheels packages show <name>	#2276 · PackagesMainCli.show()
wheels packages install <name>	#2276 · PackagesMainCli.install()
wheels packages install <name>@<version>	#2276 · $parseTarget() + VersionResolver.pick(pin)
wheels packages update <name> (explicit --yes)	#2276 · throws Wheels.Packages.ConfirmationRequired without --yes
wheels packages update --all (explicit --yes)	#2276 · $updateAll()
wheels packages remove <name>	#2276 · Installer.uninstall() (refuses dirs without package.json)
wheels packages registry refresh	#2276 · PackagesRegistryCli.refresh()
wheels packages registry info	#2276 · PackagesRegistryCli.info()
Reuse SemVer matcher from PackageLoader (#2231)	#2276 · VersionResolver delegates to wheels.SemVer
Explicit-only update policy — no auto-pull on reload	#2276 · update verbs require --yes; PackageLoader never calls the installer

Acceptance criterion

A user on Wheels 4.1 can run wheels packages install wheels-sentry and have it appear under vendor/ after reload, with the tarball sha256 verified against the registry's manifest.

Met by #2276 (sha256 hard-abort on mismatch — no --skip-checksum flag) and stabilised by #2287 ($extract gates on tar exit code, not stderr, so GNU tar's informational warnings on macOS-authored tarballs no longer fail extraction).

Follow-ups (separate issues, not blocking closure)

• Phase 3.5 aggregated registry index.json — registry-side, avoids N+1 HTTP on list.
• Phase 4 web UI — wheels-dev/wheels#2271 (shipped via feat(web): packages.wheels.dev static site (#2271) #2278).
• Retire per-file checksums in PackageLoader.cfc now that distribution-layer sha256 is authoritative.
• Defensive edge case for empty-name targets — fix(cli): reject empty-name target in wheels packages install #2290 (this was caught while doing the closure review).