fix(cli): repair CI break from bundle signing (#1060) - #1599

main has been red since #1060 merged (Build Test on f9b6e1be). Two regressions, both in the integration suite, which is why the unit suite stayed green.

1. bundle_export blows up on Typer sentinels — 20 golden tests

tests/integration/test_parser_goldens.py:273 calls bundle_export as a plain function:

bundle_export(output=bundle_path, repo=project_path, no_stats=False, context=None)

Typer only resolves defaults when it invokes the command, so the omitted sign_key keeps its OptionInfo sentinel. That sentinel is truthy, so the new if sign_key: guard passes and sign_key.encode("utf-8") then raises:

AttributeError: 'OptionInfo' object has no attribute 'encode'
  cgc_bundle.py:914 in _create_signature
  cgc_bundle.py:228 in export_to_bundle

Every test_language_golden case failed on this.

This is the bug class test_command_delegation_and_exit_codes already guards, but that meta-test only inspects command→command calls inside main.py — it can't see external callers. Rather than only fixing the one call site, I normalized the two options at the top of bundle_export, since they're the only ones here that get dereferenced rather than merely tested for truthiness. Any programmatic caller gets the same protection.

2. New bundle subcommands missing from the CLI inventory tests

#1060 added bundle verify, bundle inspect and bundle diff without updating test_cli_inventory_grouped_from_source (asserts an exact set) or test_all_canonical_cli_commands_run_with_kuzudb (asserts the smoke matrix covers the inventory).

All three take a required .cgc positional argument, so they can't be invoked bare the way that matrix invokes everything else — excluded with a comment, exactly as bundle merge already is. Their behaviour is covered by the round-trip tests.

Verification

tests/unit/         1178 passed, 7 skipped
tests/integration/    44 passed

My fault for merging #1060 on a green unit run without also running the integration suite — the signing feature itself is fine and round-trips correctly.