Repo improvements: CI feature coverage, MSRV, release hardening, docs, and CLI refactor

[Finesssee]

Summary

A batch of maintainability and correctness improvements identified during a repo review. Each logical change is a separate commit.

CI / tooling

• Test and clippy now run with --all-features (covers the secure-storage keyring path) in addition to default features.
• All cargo invocations in CI use --locked to catch Cargo.lock drift.
• Added a dedicated MSRV lane (builds on Rust 1.83.0 with --all-features).
• Declared rust-version = "1.83" in Cargo.toml and updated the README badge to match (was an unenforced 1.70+).
• Added .github/dependabot.yml for weekly cargo and github-actions updates.

Release workflow

• Dropped cargo publish --allow-dirty in favor of cargo publish --locked (the publish job checks out the clean tagged commit).
• Documented in docs/manual-release.md why the automated flow publishes to crates.io after attaching release assets, reconciling it with the manual "publish first" guidance.

Docs

• Fixed stale command examples that no longer match the CLI:
  • watch has no w alias → linear-cli watch project/team
  • config get/set default_team → valid api-key/profile keys
  • history LIN-123 → history issue LIN-123; metrics -t ENG → metrics velocity ENG
  • docs/examples.md: ui→interactive, ws→config workspace-*, j→g … --vcs jj, bulk b update→b update-state … -i
  • Unified agent skill count (27 → 38) in docs/ai-agents.md
• Added CONTRIBUTING.md mirroring the exact CI commands.

Tests

• test_version_command now asserts the real crate version via env!("CARGO_PKG_VERSION") instead of a stale "0.1" literal.

Refactor

• Extracted all clap definitions (Cli, Commands, ConfigCommands, etc.) and shared CLI state out of src/main.rs into a new src/cli.rs module, re-exported from the crate root. main.rs shrinks by ~860 lines and becomes the runtime/dispatch entrypoint.

Verification

• cargo build --locked ✅
• cargo fmt --check ✅
• cargo clippy --locked --all-features -- -D warnings ✅
• cargo test --locked --test cli_tests → 197 passed ✅
• Unit tests pass up to a pre-existing stdin-blocking test (commands::api::tests::test_resolve_query_source_none_tty) that hangs only in TTY sandboxes; unrelated to this change.

Notes

• This branch was rebuilt on the current v0.3.25 base after the workspace advanced mid-task; items already addressed upstream (pinned cross, SHA-pinned actions, corrected README bulk examples) were skipped.