docs: add next stage cicd dispatch matrix

scripts/src/help.ts

@@ -44,6 +44,7 @@ export function rootHelp(): unknown {
       { command: "dev-env validate|prewarm-images", description: "Validate D601 unidesk-dev guardrails or prewarm dev foundation images into native k3s containerd through a bounded async job." },
       { command: "artifact-registry plan|render|status|health|install|deploy-backend-core|deploy-service", description: "Manage the D601 host-managed CNCF Distribution registry and run pull-only artifact CD for supported services, including D601 direct, k3s-managed, and code-queue dev-only consumers." },
       { command: "gh auth|issue|pr", description: "Run safe GitHub issue and PR CRUD/lifecycle operations through REST with body-file update replace/append, comment delete, token diagnostics, hard delete unsupported, and merge blocked." },
+      { command: "commander contract|plan --dry-run|approval request --dry-run", description: "First-phase host Codex commander source/contract design stub; returns boundaries and approval plans without starting daemons or executing live control actions." },
       { command: "code-agent-sandbox", description: "Independent Code Agent Sandbox service skeleton for adapter, mode, and credential-boundary diagnostics." },
       { command: "schedule list|get|runs|run|retry-run|delete", description: "Manage backend-core scheduled tasks and run history; schedule run <id> supports --wait-ms N and retry-run reuses the failed run's schedule." },
       { command: "schedule upsert-pgdata-backup [--time HH:MM] [--remote-base /SERVER_DATA/UNIDESK_PG_DATA]", description: "Create or update the daily PGDATA physical backup task that uploads monthly rotated archives to Baidu Netdisk." },
@@ -185,6 +186,26 @@ function providerHelp(): unknown {
   };
 }
 
+function commanderHelp(): unknown {
+  return {
+    command: "commander contract|plan|approval",
+    output: "json",
+    usage: [
+      "bun scripts/cli.ts commander contract",
+      "bun scripts/cli.ts commander plan --dry-run [--session-id id]",
+      "bun scripts/cli.ts commander approval request --action <action> --dry-run [--reason text] [--task-id id]",
+    ],
+    description: "Inspect the first-phase source/contract design for the future host Codex commander microservice.",
+    boundary: [
+      "phase one is contract-only and never starts a daemon",
+      "dry-run commands never open SSH, PTY, or stdio bridges",
+      "high-risk actions only produce a ClaudeQQ approval draft",
+      "token and secret values must never be printed",
+    ],
+    reference: "docs/reference/host-codex-commander.md",
+  };
+}
+
 function scheduleHelp(): unknown {
   return {
     command: "schedule list|get|runs|run|retry-run|delete|upsert-pgdata-backup",
@@ -340,6 +361,7 @@ export function staticNamespaceHelp(args: string[]): unknown | null {
   if (top === "microservice") return microserviceHelp();
   if (top === "decision" || top === "decision-center") return decisionHelp();
   if (top === "provider") return providerHelp();
+  if (top === "commander") return commanderHelp();
   if (top === "schedule") return scheduleHelp();
   if (top === "codex") return codexHelp();
   if (top === "job") return jobHelp();