Modernize: oclif v4 migration + test harness + behavior-locking test suite

[paulgnz]

Summary

This PR modernizes the proton-cli toolchain in three phases, each landed in its own commit so the diff can be reviewed in stages:

1. Repair test harness. npm test was broken — the existing @oclif/test@1 errored at module load on modern Node (module.parent.filename is undefined). Bumped mocha/ts-node/@types/mocha; replaced the deprecated mocha.opts with .mocharc.json; added a small spawn-based CLI runner so behavior tests don't depend on @oclif/test internals.

2. Behavior-locking test suite. No tests existed before this. Added 138 tests covering: pure unit tests for revealPassword/encryptor/confirmation; command-registration smoke tests that walk src/commands/**/*.ts and assert each file imports cleanly + declares a description; behavior tests for the security-critical commands shipped in PR security: redact private keys and add reveal-password gate for key:get / key:list #39 (key:list, key:get, key:reveal-setup, key:reveal-disable). Suite runs in ~7s.

3. oclif v4 migration. All command files migrated from the deprecated @oclif/command@1.x to @oclif/core@4. Args migrated from legacy array syntax [{ name, required }] to v4 object syntax { name: Args.string({...}) }. flags.X(...) → Flags.X(...). CliUx.ux namespace replaced with a small compatibility shim at src/utils/ux.ts that preserves the legacy method surface (log, styledJSON, prompt, confirm, url, table) on top of console + inquirer. Removed @oclif/command, @oclif/config, @oclif/parser. Bumped @oclif/plugin-help to v6 and oclif (the build CLI) to v4.

Test suite is green throughout; tests caught a couple of pre-existing latent typing bugs that v4's stricter inference exposed (delegatebw/undelegatebw referenced args.account when only args.receiver was declared; endpoint:set referenced args.chain when only args.endpoint was declared) — both fixed in this PR.

Result: deprecation warnings on fresh install

Verified by running npm pack against this branch and npm install ./proton-cli-0.1.98.tgz in a clean directory.

	Before	After
Total npm warn deprecated lines	16	8
@oclif/* deprecation warnings	9	0

The eight remaining warnings are all transitive dependencies of packages this repo doesn't directly own. Mapping:

Deprecation	Comes via	Who fixes it
eth-sig-util@3.0.1	@proton/api	@proton/api should migrate to @metamask/eth-sig-util
ethereumjs-abi@0.6.8	@proton/api	@proton/api
lodash.isequal@4.5.0	@proton/api → @walletconnect/*	walletconnect bump
node-domexception@1.0.0	@proton/js → node-fetch chain	clears when @proton/js updates node-fetch
uuid@8.3.2	@proton/js, oclif, @oclif/test	clears when those bump
inflight@1.0.6	glob@7 chain — used by nyc and oclif	replace nyc with c8, or wait for nyc
glob@7.2.3	nyc + oclif chain	same
rimraf@3.0.2	nyc + a few others	same

Cleaning these would mean either (a) bumping @proton/js / @proton/api upstream, or (b) replacing nyc with c8 for code coverage. Neither belongs in this PR; the second one is a 5-minute follow-up if desired.

Test plan

• npm test — 138 tests, ~7s
• npm pack && npm install ../*.tgz in a clean directory — installs cleanly, deprecation count cut in half, all @oclif/* warnings gone
• Installed binary runs end-to-end: proton --version and proton key:list --help print expected output
• All commands compile under TypeScript strict mode
• Reviewer: smoke-test a few commands you care about that aren't covered by the test suite — chain operations, msig, contract:set, etc.

Notes for reviewers

• The src/utils/ux.ts shim is a deliberate choice. v4 trimmed the ux namespace dramatically (gone: log, styledJSON, prompt, confirm, url, table). Rather than rewriting every call site, the shim gives us a stable internal surface with familiar method names. ~100 lines, fully typed.
• The two codemod scripts in scripts/ (migrate-oclif.mjs and migrate-args.mjs) drove the bulk of the rewrite. They're committed for audit/reproducibility but are one-shot tools — happy to drop them in a follow-up commit if you'd prefer a cleaner tree.
• TypeScript exposed two latent bugs in legacy code (the args.account / args.chain references mentioned above). Fixed inline rather than separately so reviewers can see why the tests pass.
• Build uses tsx instead of ts-node for tests — handles the Node v22 ESM/CJS mix without the configuration gymnastics ts-node currently needs.

Branch state

• Off XPRNetwork/proton-cli@master at 1f69edc (the 0.1.98 bump merge)
• 4 commits, each phase its own logical unit
• No private key strings of any kind in any commit (verified: git diff master..modernization | grep -E 'PVT_K1_|PVT_R1_' → no matches)