[kcrmin]

What and why

• idea2strategy --help or --version reached getFirst() on an empty command list and exited 70. Both now answer in the usual JSON envelope, and an option with no command is a usage error (exit 2).
• The release .sha256 recorded the runner path, so the documented sha256sum -c failed next to the downloaded archive. It now names only the archive.
• Every release shipped 0.1.0-SNAPSHOT. A cli-vX.Y.Z tag now builds idea2strategy-X.Y.Z.zip, and --version reports X.Y.Z; a tag that is not cli-vX.Y.Z fails the workflow.

Verified

• ./gradlew :apps:idea2strategy-cli:test: 30 tests, 0 failures.
• ./gradlew :apps:idea2strategy-cli:distZip -PcliVersion=1.2.3 built idea2strategy-1.2.3.zip; the unzipped launcher answered --version with 1.2.3, --help with exit 0, --bogus with exit 2, and shasum -a 256 -c passed on a bare-name checksum.
• The workflow's tag regex accepts cli-v1.2.3 and cli-v1.2.3-rc.1 and rejects v1.2.3 and cli-v1.2.
• bash scripts/test-github-actions-pins.sh: 7 immutable references verified.
• Full ./gradlew test: 1058 tests, 1 skipped, 2 failed; both are the AccountClosurePersistenceIntegrationTest wall-clock failures fixed by test(account): pin legal hold applied_at #294.

Checklist

• CLI README updated
• No schema or API change
• No secrets or personal data