fix: fail closed on CLI input, and confirm the full footprint

[Robobc]

What

Usability-review blocker 2: invalid CLI input silently escalated to "deploy everything". Three inputs, one hole — the arg parser's *) shift ;; discarded anything unrecognized, profile/team values were validated only for the workshop action, and with no resolved target execution fell through to cdk deploy --all --require-approval never with no confirmation:

Input	What happened before
deploy --profile greenfied	flags silently skipped → full deploy, with A2A defaulted back on
deploy --stakc identity / --stack=identity	flag discarded → full deploy
deploy --team agents	team ignored → full deploy
deploy --stack identity (short name)	"No stacks match" — but only after bootstrap had already run

Fixes

• Unknown options and the --opt=value form are errors that name the valid option set.
• --profile / --team values are validated for every action, listing the valid values.
• --stack values must be full stack names — prefix-checked before any AWS call, with deploy.sh ls as the pointer.
• A deploy or destroy with no target prints the plan first — account, region, config source (platform.yaml / workshop.env / defaults), and the exact stack list from cdk ls — then asks. --yes skips the prompt; NON_INTERACTIVE=1 implies --yes, so CI flows are byte-for-byte unchanged.

═══ Plan — deploy the FULL footprint ═══
[INFO]  Account: 111122223333   Region: us-east-1   Prefix: agentcore-workshop-dev
[INFO]  Config source: workshop.env
[INFO]  Stacks:
    agentcore-workshop-dev-auth
    agentcore-workshop-dev-identity
    ...
Proceed to deploy ALL of the above? [y/N]:

Checks

Two new self-checks in check-deploy-config.sh:

• (n) invokes the real deploy.sh and asserts every bad input above exits non-zero at parse/validation time — before credentials are ever checked — and that --yes parses as a flag rather than dying as an unknown option.
• (o) drives confirm_footprint through all four paths (--yes skip, NON_INTERACTIVE skip, answer-n abort with non-zero exit, answer-y proceed) with npx stubbed.

Verified

17 self-checks green, workshop --dry-run end-to-end green, shellcheck clean, workshop-flow checks green. No shared files with #35 or #36 — any merge order works.

[github-actions]

Commit: 4a84f0b | Updated: 2026-08-25 10:18:07 UTC

Security Scan Results

Scanner	S	C	H	M	L	I	Time	Action	Result	Thresh
bandit	0	0	0	0	0	0	541ms	0	PASSED	MED (g)
cdk-nag	0	0	0	0	0	0	7.1s	0	PASSED	MED (g)
cfn-nag	0	0	0	0	0	0	8ms	0	PASSED	MED (g)
checkov	0	0	0	0	0	0	5.4s	0	PASSED	MED (g)
detect-secrets	0	5	0	0	0	0	882ms	5	FAILED	MED (g)
grype	0	0	0	0	0	0	1m 1s	0	PASSED	MED (g)
npm-audit	0	0	0	0	0	0	181ms	0	PASSED	MED (g)
opengrep	0	0	0	0	0	0	17.9s	0	PASSED	MED (g)
semgrep	0	0	0	0	0	0	<1ms	0	MISSING	MED (g)
syft	0	0	0	0	0	0	1.9s	0	PASSED	MED (g)