[bug] env list --reveal keeps values masked; only env --reveal reveals them #1432

Problem

teamai env list --reveal still masks values. teamai env --reveal, the parent command's default listing, shows them. The documented form is the one that does not work: skill-data/setup/references/manage-admin.md:260 tells members to run teamai env list --reveal.

Reproduced on 0.28.0 and on main (e612a5ae0), macOS arm64:

$ teamai env list --reveal
  DEMO_URI=pl****  env.yaml  (root)
$ teamai env --reveal
  DEMO_URI=plain-default-value  env.yaml  (root)

Cause

Both the parent env command (src/index.ts:721-730) and env list (src/index.ts:732-740) declare --reveal. With Commander's default option parsing (commander ^12.1, no enablePositionalOptions()), the parent consumes an option it knows wherever the option sits on the command line. So env list --reveal sets reveal on env, and the list action passes only its own cmdOpts to envList, where reveal is unset.

src/pkg/register-command.ts already resolves options with optsWithGlobals() for the same reason. That is a precedent in this repo, not a prescribed fix.

Steps to reproduce

Use an isolated HOME and a local bare repo as the team repo:

ROOT=$(mktemp -d); URL=https://git.example.com/team/t.git
mkdir -p $ROOT/seed/env
printf 'team: t\nrepo: %s\nprovider: git\nreviewers: []\n' "$URL" > $ROOT/seed/teamai.yaml
printf 'variables:\n  - key: DEMO_URI\n    value: plain-default-value\n' > $ROOT/seed/env/env.yaml
git -C $ROOT/seed init -q -b main && git -C $ROOT/seed add -A && git -C $ROOT/seed commit -qm seed
git clone -q --bare $ROOT/seed $ROOT/t.git
export HOME=$ROOT/home; mkdir -p $HOME/.claude; cd $HOME
git config --global url."$ROOT/t.git".insteadOf "$URL"
teamai init "$URL" --provider git --agent claude --scope user --force
teamai env list --reveal   # masked: the bug
teamai env --reveal        # plaintext

Approach

• Make env list honour --reveal whichever command Commander binds it to. Keep teamai env --reveal working, since the parent's default action is kept for backward compatibility.
• Do not change what --reveal reveals. A secret never shows a value, --reveal included (manage-admin.md:308).
• Keep the change to the env command wiring. If the option help text changes, regenerate skill-data/core/references/commands.md with npx vitest run commands-reference -u.

Acceptance criteria

• teamai env list --reveal prints variable values in plaintext.
• teamai env --reveal still prints them in plaintext.
• teamai env list and teamai env without the flag still mask values.
• Secrets stay unrevealed with --reveal in both forms: status only (team, global, environment, missing or unreadable), never a value.
• A test drives the CLI's command table with env list --reveal and fails on current main. Calling envList({ reveal: true }) directly does not count, because that path already works.

Definition of done

• npx tsc --noEmit, npm run lint and npx vitest run pass.
• After npm run build, the PR body pastes one real-CLI run of the steps above, showing both commands revealing the variable and a secret staying masked (AGENTS.md, "Testing before a PR").
• commands.md is regenerated if any command or option help changed. Otherwise no doc change: the docs already describe the intended behavior.
• The diff touches only the env command wiring and its test.