feat(cli): M8 — headless one-shot mode (-p / --print)

[oratis]

Summary

Removes the "Headless mode is wired in M8" stub at apps/cli/src/cli.ts:42 and ships the real thing.

• apps/cli/src/headless.ts (NEW) — full bootstrap (settings, creds, tools, memory, skills, output style, MCP, hooks, sandbox, autoCompact) but runs a SINGLE turn instead of a readline loop. Three output formats:
  • text — plain deltas + minimal tool markers (default)
  • json — single final JSON object on stdout at exit (full transcript + usage + exitCode)
  • stream-json — NDJSON, one event per line, suitable for piping into another process
• Approval callback returns false in headless (no human to ask). Use --mode dontAsk or --mode bypassPermissions (trust-gated) for auto-approval.
• SIGINT/SIGTERM wired to AbortController → exit code 5.
• 5 stable exit codes (documented in --help): 0 ok / 1 generic / 2 bad-input / 3 api-or-auth / 4 max-turns / 5 aborted.
• cli.ts replaces the stub branch with a real runHeadless() call.

Test plan

• pnpm -F deepcode-cli test — 43 passing (was 41; +2 in headless.test.ts)
• pnpm -F deepcode-cli build — clean
• Smoke: HOME=/tmp/empty node apps/cli/dist/cli.js -p "hi" → prints "No DeepSeek credentials.", exits 3 ✅
• Smoke: same with --output-format json → same exit 3 ✅
• docs/BEHAVIOR_PARITY.md updated — -p moves to ✅, output-format to 🟡 (full pieces still pending json-schema)

Notes

• The test file is intentionally minimal (early-exit paths only) because mocking DeepSeekProvider from the host process is awkward without dep injection. Live end-to-end is exercised via docs/m1-validation.md against the real API.
• json-schema and include-partial-messages remain parsed-only (M8-rest).

🤖 Generated with Claude Code