Addresses 18 review comments from BYK on the generator-commands PR:

#2: Use result.user = user instead of cherry-picking fields (login.ts)
#3: Remove process.stdin param from runInteractiveLogin (interactive-login.ts)
#4: Use return yield pattern for one-liner yields (logout.ts)
#5: Make OutputConfig.json optional (defaults to true) (output.ts)
#6: Convert trace/logs.ts to yield commandOutput (trace/logs.ts)
#7: Move URL/QR display through yield commandOutput (trial/start.ts)
#8: Rename const log → const logger, import logger as log (trial/start.ts)
#9: Convert help.ts to yield commandOutput (help.ts)
#11: Replace Symbol branding with class + instanceof for CommandOutput (output.ts, command.ts)
#12: Remove jsonlLines/JSONL mechanism — each yield becomes one JSON line (output.ts, log/list.ts)
#15-#17: Replace polling dots with spinner in interactive login (interactive-login.ts)
#18: Yield individual log items in follow mode (log/list.ts)

Key changes:
- CommandOutput is now a class using instanceof instead of Symbol branding
- JSONL support removed — streaming commands yield items individually
- trace/logs.ts uses OutputConfig with human/jsonTransform instead of manual stdout
- help.ts yields through output framework
- trial/start.ts handlePlanTrial is now an async generator yielding display data
- interactive-login.ts uses consola spinner for polling, removes stdin param
- OutputConfig.json is now optional (defaults to true when object form is used)

Tests updated for trace/logs and trial/start to use context stdout.

Addresses 18 review comments from BYK on the generator-commands PR:

#2: Use result.user = user instead of cherry-picking fields (login.ts)
#3: Remove process.stdin param from runInteractiveLogin (interactive-login.ts)
#4: Use return yield pattern for one-liner yields (logout.ts)
#5: Make OutputConfig.json optional (defaults to true) (output.ts)
#6: Convert trace/logs.ts to yield commandOutput (trace/logs.ts)
#7: Move URL/QR display through yield commandOutput (trial/start.ts)
#8: Rename const log → const logger, import logger as log (trial/start.ts)
#9: Convert help.ts to yield commandOutput (help.ts)
#11: Replace Symbol branding with class + instanceof for CommandOutput (output.ts, command.ts)
#12: Remove jsonlLines/JSONL mechanism — each yield becomes one JSON line (output.ts, log/list.ts)
#15-#17: Replace polling dots with spinner in interactive login (interactive-login.ts)
#18: Yield individual log items in follow mode (log/list.ts)

Key changes:
- CommandOutput is now a class using instanceof instead of Symbol branding
- JSONL support removed — streaming commands yield items individually
- trace/logs.ts uses OutputConfig with human/jsonTransform instead of manual stdout
- help.ts yields through output framework
- trial/start.ts handlePlanTrial is now an async generator yielding display data
- interactive-login.ts uses consola spinner for polling, removes stdin param
- OutputConfig.json is now optional (defaults to true when object form is used)

Tests updated for trace/logs and trial/start to use context stdout.

…786)

## Summary

Surfaces the highest-signal env vars directly in `sentry --help` and
adds an `envVars` array to `sentry help --json`.

Previously, `SENTRY_AUTH_TOKEN`, `SENTRY_FORCE_ENV_TOKEN`, and friends
lived only in [configuration.md](https://cli.sentry.dev/configuration/).
Users hitting odd auth behavior had to leave the terminal to discover
them. This matches how `gh --help` surfaces `GH_TOKEN` / `GH_HOST` at
the top level.

**Surfaced vars:** `SENTRY_AUTH_TOKEN`, `SENTRY_FORCE_ENV_TOKEN`,
`SENTRY_ORG`, `SENTRY_PROJECT`, `SENTRY_DSN`, `SENTRY_HOST`,
`SENTRY_LOG_LEVEL`, `NO_COLOR`.

Source of truth is `env-registry.ts`: entries gain an optional
`topLevel` flag plus a one-line `briefDescription` used in the branded
help summary. The full catalog of every env var remains in
`configuration.md` unchanged.

## Test plan

- `bun test test/lib/help.test.ts` — new test cases assert each
top-level var appears both in `printCustomHelp()` output and in
`introspectAllCommands().envVars`.
- `bun run typecheck`, `bun run lint` — clean (one pre-existing
unrelated warning).
- Full unit suite: 5263 passing.

Part of #785 (addresses items #5 and #6).

…#1106)

## Summary

Resolves the open Dependabot security alerts for `getsentry/cli`. `gh
security-advisories` was empty; Dependabot had 7 open alerts (plus 1
already-fixed astro alert). This PR fixes 6 of them via dependency
updates; the 7th has no upstream patch and is dismissed separately.

## Alerts fixed

| # | Package | Severity | Fix | Where |
|---|---------|----------|-----|-------|
| 8 | esbuild | High (RCE via `NPM_CONFIG_REGISTRY`) | 0.28.1 | root |
| 7 | esbuild | High (RCE) | 0.28.1 | docs |
| 6 | esbuild | Low (Windows path traversal) | 0.28.1 | docs |
| 5 | shell-quote | Critical (command injection) | 1.8.4 | root |
| 3 | qs | Medium (DoS) | 6.15.2 | root |

## Changes

- **Root `package.json`**: bump direct `esbuild` to `^0.28.1` (used by
`script/build.ts`, `script/bundle.ts`, `script/text-import-plugin.ts`);
add `pnpm.overrides` pinning the vulnerable transitive ranges of
`esbuild`, `shell-quote`, and `qs` to patched versions; bump
`@mastra/client-js` to `^1.24.0`.
- **`docs/package.json`** (standalone, non-workspace pnpm project): add
`pnpm.overrides` for `esbuild` (covers alerts #6 and #7).
- Regenerated both `pnpm-lock.yaml` files. `pnpm.overrides` lives under
the `pnpm` key, so `check:deps` (no root `dependencies`) still passes.

## Not in this PR

- **Alert #4** (`@ai-sdk/provider-utils`, CVE-2026-8769, Low): no
patched version exists upstream (`first_patched_version: null`). Max
stable 3.x (3.0.26) is still within the affected range `<=3.0.97`, and
only the 4.x major escapes it — but that would break the v5 consumers
(`@ai-sdk/ui-utils` pins 2.2.8). Bumping `@mastra/client-js` does not
remove the vulnerable instances. Dev-only/inconclusive transitive dep.
**Dismissed on GitHub as `tolerable_risk`** pending an upstream fix.
- **Alert #2** (astro XSS): already fixed on `main` (resolved to astro
6.3.7 ≥ 6.1.6).

## Verification

- `pnpm run check:deps` ✓
- `pnpm run typecheck` ✓
- `pnpm run build` ✓ (esbuild 0.28.1 bundle + Node SEA binary)
- Confirmed no vulnerable `esbuild`/`shell-quote`/`qs` versions remain
in either lockfile.