CLI dual flag system for dry-run vs execute is confusing

[github-actions]

Issue

The CLI uses a confusing dual flag system for controlling dry-run vs live execution that could lead to user errors.

Current behavior

Both execute and run commands have:

• --dry-run (defaults to true)
• --execute (defaults to false)

To actually run (not dry-run), users must pass --execute, which overrides the default --dry-run=true.

Problems

1. Counter-intuitive: Users might expect --dry-run=false to enable live execution
2. Documentation gap: The relationship between these flags isn't clearly explained
3. Error-prone: Easy to forget --execute and accidentally run dry-run when expecting live execution

Source evidence

File: src/cli.ts lines for execute command:

.option("--dry-run", "Log actions without executing", true)
.option("--execute", "Actually execute the plan (opt-in)", false)

Runtime logic: const dryRun = !opts.execute;

Suggested improvements

1. Documentation: Add clear explanation of flag interaction to CLI reference
2. UX: Consider simplifying to single --execute flag (dry-run by default)
3. Validation: Add warning when conflicting flags are used

Related

Connected to issue #2 about unclear dry-run behavior in quickstart guide.