#3184 fix(cli): recover from missing notifyAppReady / public key / appId

Summary (AI generated)

• Addressed all CodeRabbit review feedback on CLI recovery flows for missing notifyAppReady, public key, and appId
• Hardened build patching (callable/aliased updater bindings, CommonJS destructuring, no false-positive patches)
• Made app ID persistence best-effort, guarded encrypt key recovery, and fixed public-key precedence over stale files

Motivation (AI generated)

Branch protection required an approving review. CodeRabbit requested changes across recovery correctness, maintainability, and edge cases that could produce broken bundles or misleading recovery output.

Business Impact (AI generated)

Interactive CLI recovery is safer and more reliable for customers missing Capgo config, reducing failed uploads/encryption and incorrect auto-detected app IDs without silencing real errors.

Test Plan (AI generated)

• bun run cli:check passes locally
• Expanded cli/test/test-cli-recovery.mjs coverage for aliased bindings, mixed CJS destructuring, stale pub keys, and patch skip cases
• CI green on PR
• CodeRabbit @coderabbitai approve with 0 unresolved review threads

Generated with AI

  

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

Summary by CodeRabbit

• New Features

  • Added automatic app ID recovery during bundle operations, including detection, selection, and creation.
  • Added public-key recovery from private keys or by generating new key pairs.
  • Added recovery options for missing notifyAppReady() calls, including build/source patching or skipping.
  • Added --ignore-notify-app-ready to bundle upload and zip commands.

• Bug Fixes

  • Improved key validation, configuration refresh, and recovery during encryption and uploads.

• Tests

  • Added coverage for CLI recovery workflows, bundle patching, key handling, and failure reporting.