Improve ask-cli reliability and resolver coverage

[RobertTLange]

What changed

• Honor --executable and --package-root during resolution, collection, cache keys, and staged output.
• Surface low-confidence, fallback, truncated-context, and fallback-execution uncertainty in human and JSON output.
• Make collection cache keys include limits, exec options, overrides, and metadata fingerprints.
• Enrich fallback context with script bodies, adjacent docs/config, and bounded man output.
• Expand resolver coverage for wrapper shims, npm/Python env layouts, and Homebrew docs/man metadata.
• Harden local integration fixtures and progress-label probing for live Headless backends.

Why

These changes make ask-cli more explicit when context is uncertain, avoid stale cache reuse across collection modes, and improve package identification for common real-world CLI install layouts.

Testing

• npm test: passed (130/130)
• npm run test:integration:local: passed (default Codex selection, 3/3)
• ASK_INTEGRATION_AGENTS=cursor npm run test:integration:local: passed (2 passed, 1 skipped)
• ASK_INTEGRATION_AGENTS=opencode npm run test:integration:local: failed: Opencode exited 0 after emitting only an inspection preamble, with no final nonce answer.
• ASK_INTEGRATION_AGENTS=all npm run test:integration:local: failed for the same Opencode final-answer behavior after other live backends passed their preflight and earlier slices.

Notes

The remaining full-suite blocker appears to be live Opencode/Headless final-answer behavior, not package resolution or context staging: Opencode reports tool reads and exits successfully but ask receives no final answer containing the fixture nonce.

[RobertTLange]

Review fixes pushed in two commits:

• f88c4e8 fix: limit manpage collection to fallback

  • Added a regression test proving npm/non-fallback collection does not call man.
  • Gated collectManOutput behind resolution.ecosystem === "fallback", while preserving fallback manpage coverage.

• 14e7ff3 fix: bound executable text reads

  • Added bounded UTF-8 prefix/file-read helpers.
  • Replaced whole-file executable reads in wrapper resolution and fallback text detection with bounded reads.
  • Added direct tests for prefix reads and oversized-file rejection.

Validation:

• Targeted red/green checks for each fix.
• Full npm test: 133/133 passing.