test(cli): edge-case unit tests for pure helpers; raise coverage ratchet

internal/cli is the largest, least-covered package (orchestration) — but many
of its helpers are pure and were untested. Add hermetic, table-driven, edge-case
tests for 19 of them: version parsing (getFeatureIdWithoutVersion incl. digest
pins and registry ports, highestSatisfyingTag, majorOf), arg handling
(appPortPublishArgs, splitExecArgs with the `--`/value-flag rules, envSliceToMap
with `=`-in-value and last-wins), formatting (textTable ragged rows/trailing
trim, encloseStringInBox rune width), config (buildArgs/OptionsFromConfig nil
paths, featureKeyOrderFromFile order, orderedFeatureKeys never-drop invariant),
and misc (folderImageName determinism, addFeatureOption non-map, ociAnnotationID
bad JSON, appliedAny, proxyEnvFromEnviron).

internal/cli 29.1% -> 33.1%, total 50.3% -> 52.6% (hermetic lane). Raise the
ratchet floors accordingly (COVERAGE_MIN 48->52, cli 28->32).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: aledbf

Taskfile.yml

@@ -10,11 +10,11 @@ vars:
   LDFLAGS: -s -w -X {{.MODULE}}/internal/product.version={{.VERSION}} -X {{.MODULE}}/internal/product.name={{.BINARY}}
   # Minimum hermetic-unit statement coverage the `coverage` gate enforces. Set as a
   # ratchet just below the current level; raise it as coverage grows (never lower).
-  COVERAGE_MIN: "48"
+  COVERAGE_MIN: "52"
   # Package ratchets prevent well-covered parsing packages from masking a
   # regression in the orchestration layers. Keep these just below the measured
   # hermetic baseline and only move them upward.
-  COVERAGE_CLI_MIN: "28"
+  COVERAGE_CLI_MIN: "32"
   COVERAGE_DOCKER_MIN: "77"
   COVERAGE_LIFECYCLE_MIN: "73"
   COVERAGE_OCI_MIN: "85"