fix(pack): an unsupported --format value writes nothing to stdout

`mcpp pack --format bogus` must write NOTHING to stdout and exit 2. That is the
machine-output contract, and 202_machine_output_contract.sh asserts it for
exactly this command, because it is the path a client hits when it probes an
mcpp for a capability -- the most common machine-facing failure, and the one
that used to print to stdout.

Moving the refusal from the CLI parser to after `prepare_build` broke it. It
had to move: the set of valid values is a property of the RESOLVED GRAPH, so a
refusal written in the parser could only compare against a constant, which is
the coupling this whole mechanism exists to remove. But prepare narrates what
it resolves, so the refusal now arrived after three lines on stdout.

    FAIL: unsupported value (pack) wrote to stdout:    Resolving toolchain

Measured on macos-arm64, and it would have failed on every platform -- the
macOS shard is simply the one that reached it first.

The fix is to be quiet until the value is validated, and only then. Nothing is
lost when the value IS valid: the dispatch pass prepares a second time and
prints the same lines, so a successful `pack --format <name>` narrates once
rather than twice. `--format tar` and `--format dir` are untouched, because
their values were never in question.

The musl re-prepare is quieted on the same grounds: it also runs before the
format has been validated.

The assertion is added to 638_pack_format_dispatch.sh as well as living in 202.
That is deliberate duplication: the tension is local to this feature -- the
valid set needs the graph, and the graph narrates -- so the test for the
feature should fail when the contract does, rather than only the general
contract test noticing.

Author: speak-agent

src/pack/pipeline.cppm

@@ -57,8 +57,24 @@ export int build_and_pack(Options opts, bool modeFromUser,
     ov.profile          = opts.profile;
     ov.profile_fallback = "release";
 
+    // QUIET FOR A DISPATCHED FORMAT, AND ONLY UNTIL THE VALUE IS VALIDATED.
+    //
+    // `mcpp pack --format bogus` must write NOTHING to stdout and exit 2 --
+    // the machine-output contract, asserted by
+    // tests/e2e/202_machine_output_contract.sh, because this is the path a
+    // client hits when it probes an mcpp for a capability. The set of valid
+    // values is a property of the resolved graph, so the refusal cannot be
+    // decided until prepare has run, and prepare narrates what it resolves.
+    //
+    // Nothing is lost when the value IS valid: the dispatch pass prepares a
+    // second time and prints the same lines, so a successful
+    // `pack --format <name>` narrates once rather than twice.
+    const bool quietUntilValidated =
+        opts.format == mcpp::pack::Format::Dispatched && !mcpp::ui::is_quiet();
+    if (quietUntilValidated) mcpp::ui::set_quiet(true);
     auto ctx = mcpp::build::prepare_build(/*print_fp=*/false, /*includeDevDeps=*/false,
                              /*extraTargets=*/{}, ov);
+    if (quietUntilValidated) mcpp::ui::set_quiet(false);
     if (!ctx) {
         mcpp::ui::error(ctx.error());
         return 2;
@@ -91,7 +107,11 @@ export int build_and_pack(Options opts, bool modeFromUser,
         // overrides object left behind here would make that pass differ from
         // this build in a way nothing states.
         ov.target_triple = "x86_64-linux-musl";
+        // Quiet on the same grounds as the first prepare: this one also runs
+        // before `--format` has been validated.
+        if (quietUntilValidated) mcpp::ui::set_quiet(true);
         auto ctx2 = mcpp::build::prepare_build(false, false, {}, ov);
+        if (quietUntilValidated) mcpp::ui::set_quiet(false);
         if (!ctx2) { mcpp::ui::error(ctx2.error()); return 2; }
         ctx = std::move(ctx2);
     }

tests/e2e/638_pack_format_dispatch.sh

@@ -130,6 +130,20 @@ grep -q "available in this build: tar, dir, zap" b2.log \
 # Nothing was compiled to find that out.
 grep -q "Compiling app" b2.log \
   && { cat b2.log; echo "FAIL: the refusal arrived after a compile"; exit 1; }
+# AND NOTHING REACHED STDOUT. This is the path a client hits when it probes an
+# mcpp for a capability, so the machine-output contract
+# (202_machine_output_contract.sh) requires an empty stdout, a non-empty stderr
+# and exit 2. It is asserted here as well because the tension is local to this
+# feature: the valid set is a property of the resolved graph, so the refusal
+# cannot be decided until prepare has run -- and prepare narrates what it
+# resolves. Deciding it later is what broke the contract once.
+set +e
+so=$("$MCPP" pack --format bogus 2>/dev/null); rc=$?
+se=$("$MCPP" pack --format bogus 2>&1 >/dev/null)
+set -e
+[ -z "$so" ] || { echo "FAIL: the refusal wrote to stdout: $(echo "$so" | head -1)"; exit 1; }
+[ -n "$se" ] || { echo "FAIL: the refusal said nothing on stderr"; exit 1; }
+[ "$rc" = 2 ] || { echo "FAIL: the refusal exited $rc, expected 2"; exit 1; }
 
 # ── 3. the dispatched format produces a file, and it saw the staged tree ───
 "$MCPP" pack --format zap > b3.log 2>&1 || { cat b3.log; echo "FAIL: pack --format zap failed"; exit 1; }