cli: align with Typer's bundled agent skill

[richardmhope]

Reviewed src/icebergsca/cli/main.py against the agent skill Typer ships at typer/.agents/skills/typer/SKILL.md (typer 0.27.0), and closed the gaps.

Already aligned

Explicit typer.Typer() app rather than typer.run; Annotated throughout, with no old-style = typer.Option(...) defaults or default=... ellipsis; no_args_is_help on the root app; list[str] for the repeatable --exclude; a boolean flag pair on sbom; an eager --version callback. None of the Click-era settings the skill calls out (expose_value, shell_complete, show_choices, errors, prompt_required, is_flag, flag_value, allow_from_autoenv) appear anywhere in src/, and nothing imports Click.

--scope and --ecosystem are now Typer enum lists

They took a single comma-separated str and hand-rolled the splitting and enum validation, so --help rendered <str> and advertised no choices — inconsistent with --format, which Typer converts natively, and with --exclude in the same command, already a list. The skill's "CLI options with multiple values" section is explicit that a multi-value option is a list.

They are now list[Scope] | None and list[EcosystemId] | None. Typer derives the metavar, validates each value, and rejects a bad one as a usage error on its own, so _parse_enum_option, _choices_metavar and the EnumT TypeVar are all gone — 42 lines out, 8 in.

--scope       <runtime|dev|test|build|optional>          Scope to include, overriding --include-dev. Repeatable.
--ecosystem   <pypi|npm|maven|go|cargo|nuget|rubygems>   Ecosystem to restrict to. Repeatable.

$ icebergsca scan . --scope prod
Invalid value for '--scope': 'prod' is not one of 'runtime', 'dev', 'test', 'build', 'optional'.   # exit 2

Breaking: --scope runtime,dev is now a usage error; use --scope runtime --scope dev. Taken on the basis that there are no deployments to keep compatible. Exit codes and the rest of the help output are unchanged.

Other fixes

• The sbom docstring used RST double backticks, which the default Rich markup mode renders literally in --help. Now uses [bold], per the skill's Rich section.
• rich_markup_mode is stated on the app rather than inferred, so help output does not change shape with what else is installed.
• sbom's -v/-q had no help text, unlike the same flags on scan.
• The cache sub-app lacked no_args_is_help, so a bare icebergsca cache errored with exit 2 while a bare icebergsca printed help.
• Floored typer at 0.26, the release that vendored Click. Below that, an unrelated Click upgrade in the same environment governs this CLI's parsing and exit codes — and ExitCode.USAGE = 2 is justified in its own docstring by Click's reservation of that code. The lock already resolved to 0.27.

Docs

README.md, website/docs/cli.md, website/docs/ecosystems.md and the bundled .agents/skills/icebergsca/SKILL.md now show the repeated form, per the CLAUDE.md rule that a skill describing flags that no longer exist is worse than none.

Verification

ruff check, ruff format --check, mypy and pytest all pass — 386 tests, up from 384. Added test_scope_flag_is_repeatable and test_enum_choices_are_listed_in_help, the latter asserting the choices reach --help so a future switch back to a bare <str> metavar fails loudly.

Dogfooded icebergsca scan . --ecosystem pypi --scope runtime --scope build --format json — 50 dependencies, correct scope union.