refactor(cli): cover the upgrade, flags and filesystem modules with effect lint (CLI-2648)

[7ttp]

TL;DR

brings the upgrade, flags and filesystem modules under the effect lint, with the output, status and go-compat helpers around them

whats introduced?

• the module files join the allow list, with upgrade-notice left to its own follow-up
• pflag-reconcile reads SUPABASE_PROFILE, SUPABASE_WORKDIR and the supabase home from CommandSettings instead of process.env, so profileFilePath goes
• git-status takes the Path service, timestamp.format goes through DateTime, and the go-struct-output and string-slice-flag errors move to Data.Error with the same names and fingerprints
• the tests swap node:fs and process.env for scoped temp dirs and config providers, and the prompt-yes-no and pflag-reconcile tests move to it.effect

ref

• related: CLI-2648

[github-actions]

🤖 AI Review

Both independent reviews were available. Confirmed one redundant-service-provision nit and refuted the duplication-only nit under trusted repository conventions. Codex reported no findings. Verification was by code inspection; tests were not run.

Findings

Severity	Location	Category	Sources	Claim
⚪ NIT	apps/cli/src/command-internal/pflag-reconcile.unit.test.ts:316	test-quality	claude	The services() helper redundantly includes BunServices.layer because both tests using it already provide that layer around the outer effect.

Refuted findings (kept for transparency, not posted as review comments)

• apps/cli/src/command-internal/upgrade-notice.unit.test.ts:761 (duplication): Duplicated captureStderr and withMode test helpers should be centralized to prevent maintenance drift.
  Refuted: The duplication exists, but trusted/CLAUDE.md:159 explicitly accepts some duplication instead of unnecessary test abstractions, and trusted/apps/cli/CLAUDE.md:36-38 says not to automatically extract every helper used twice. Both stderr helpers restore the original writer through acquireUseRelease. The chmod helpers also restore permissions, with the configurable variant supporting both file and directory modes. No faulty behavior or maintenance drift was identified; duplication alone does not establish a quality defect under these conventions.

Stats

Claude findings: 2 · Codex findings: 0 · Confirmed: 1 · Refuted: 1 · Uncertain: 0

---

Models: claude-opus-5-5 + gpt-6.1-sol · Trigger: auto · Workflow run

This review runs once per PR. A maintainer can request another with a /ai-review comment.