docs(m171): add spec — one argument rejection shape and exit code

Every command-line interface (CLI) command currently answers a bad
invocation in one of two dialects: the handler-side house shape
(✕ error + Suggestion, exit 4) for logs/grant/memory/install, and
commander's raw text (exit 2) for roughly twenty others. Exit 2 is
already NetworkError in the EXIT_CODE map, so a script cannot tell a
mistyped command from an unreachable daemon.

M171_001 unifies both on the house shape and exit 4 through one
re-render in applyOutputToTree, routes bare group help to stdout, and
moves the negative-path sweep out of the credentialed live acceptance
lane into the deterministic one so events/steer rejection is proven on
every commit.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>