feat: add HWLAB dev CD CLI wrapper

scripts/src/help.ts

@@ -1,5 +1,6 @@
 import { ghHelp } from "./gh";
 import { authBrokerHelp } from "./auth-broker";
+import { hwlabHelp } from "./hwlab-cd";
 
 export function rootHelp(): unknown {
   return {
@@ -48,6 +49,7 @@ export function rootHelp(): unknown {
       { command: "auth-broker contract|health --dry-run|credential-request --dry-run|pr-preflight --dry-run", description: "Inspect the P0 Rust auth broker and CLI adapter contract without reading token values, writing GitHub, or starting services." },
       { command: "gh preflight|auth|issue|pr", description: "Run safe GitHub issue and PR CRUD/lifecycle operations through REST with body-file update replace/append, comment delete, token diagnostics, PR closeout preflight, hard delete unsupported, and merge blocked." },
       { command: "commander contract|plan --dry-run|smoke --dry-run|approval request --dry-run|prompt-lint --kind gpt55-pr", description: "Host Codex commander skeleton contract, no-daemon smoke plan, dry-run approval preview, and advisory GPT-5.5 PR prompt boundary lint without live bridges, message sends, or submit gating." },
+      { command: "hwlab cd status --env dev | hwlab cd apply --env dev --dry-run", description: "Bounded HWLAB DEV CD wrapper that calls HWLAB repo-owned scripts, forces D601 native k3s kubeconfig, refuses Docker Desktop control-plane signals, and writes full stdout/stderr dumps." },
       { command: "code-agent-sandbox", description: "Independent Code Agent Sandbox service skeleton for adapter, mode, and credential-boundary diagnostics." },
       { command: "schedule list|get|runs|run|retry-run|delete", description: "Manage backend-core scheduled tasks and run history; schedule run <id> supports --wait-ms N and retry-run reuses the failed run's schedule." },
       { command: "schedule upsert-pgdata-backup [--time HH:MM] [--remote-base /SERVER_DATA/UNIDESK_PG_DATA]", description: "Create or update the daily PGDATA physical backup task that uploads monthly rotated archives to Baidu Netdisk." },
@@ -483,5 +485,6 @@ export function staticNamespaceHelp(args: string[]): unknown | null {
   if (top === "artifact-registry") return artifactRegistryHelp();
   if (top === "auth-broker") return authBrokerHelp();
   if (top === "gh") return ghHelp();
+  if (top === "hwlab") return hwlabHelp();
   return null;
 }