Bare wanctl prints help; wanctl start enrolls the device

[Daily-AC]

Summary

Bare wanctl stops being an action. It prints the help plus one line of local
status and returns; wanctl start does the enrolling.

• main.go — the no-argument path prints usage and localStatusLine(). It no
  longer runs the first-run relay gate, so it asks nothing and writes nothing.
  The up case, cmdUp and the now-unused runRelayCommand are gone, and up
  is out of relayCommands.
• daemon.go — cmdStart(ctx) logs in when there is no token, via the
  enrollForStart variable so a test can drive the rest of start without a
  portal. localStatusLine() is the new status line.
• internal/config/lock.go — AgentRunning opens agent.lock without
  O_CREATE. Asking whether an agent runs must not create the file that records
  that one ever did; no lock file also answers the question.
• Usage text, and internal/config/store.go's reference to the token "saved by
  wanctl up".

Root cause

main.go dispatched len(os.Args) < 2 to cmdUp, which enrolled if there was
no token and then called cmdStart. Reading the help and onboarding a device
were the same keystroke. cmdStart reinforced it by refusing without a token
and telling the user to "先运行 wanctl（无参）完成登录授权", so the documented
way to enroll was the same command someone would type to look around.

wanctl login was already correct — it takes a credential and starts nothing —
so only the device half moved.

up is removed rather than kept as an alias. I checked every caller the brief
named: grep -rn cmdUp finds only the bare path; the Android app runs
Wanctl.run(…, "login", "--code", …) and AgentService execs agent; neither
scripts/install.sh.in nor scripts/install.ps1.in invokes wanctl at all after
installing; cmdSupervise runs agent --managed; service.go writes units that
run agent.

Doc files touched

For the portal re-sync after deploy:

docs/portal/quickstart__enroll-device.md
docs/portal/quickstart__enroll-device.en.md
docs/portal/quickstart__windows-install.md
docs/portal/quickstart__windows-install.en.md
docs/self-hosting.md
docs/self-hosting.zh.md
internal/relay/skill.md
internal/portal/changelog/v0.8.1.md   (new)

README.md and docs/android*.md already said wanctl start where it matters
and needed no change; their remaining bare-wanctl mentions are about PATH
resolution, not enrollment. firstrun.go never told anyone to run bare wanctl.

Test plan

$ go test . -run 'BareInvocation|UnknownSubcommand|Start|Login|LocalStatusLine' -v
--- PASS: TestBareInvocationPrintsHelpAndTouchesNothing (1.20s)
--- PASS: TestUnknownSubcommandStillFails (0.87s)
--- PASS: TestStartEnrollsWhenThereIsNoToken (0.00s)
--- PASS: TestStartWithAnAgentAlreadyRunningDoesNothing (0.00s)
--- PASS: TestLoginNeverRecordsAnAgent (0.00s)
--- PASS: TestLocalStatusLineReportsBothHalves (0.00s)

The bare-invocation test builds the binary and runs it against a temp config
directory with no relay configured, then asserts exit 0, the help and the status
line on stdout, and that none of token, agent.pid, agent.lock, cert.pem,
key.pem or device_id was created. Running with no relay is deliberate: it is
what proves the first-run question is not reached.

TestStartEnrollsWhenThereIsNoToken stubs the login to fail and asserts start
attempted it exactly once, returned that failure, and recorded no agent.
TestStartWithAnAgentAlreadyRunningDoesNothing holds the lock and asserts the
login is not re-run. TestLoginNeverRecordsAnAgent asserts login leaves no
agent.pid and no agent.lock.

Full gate clean: gofmt -l ., go vet ./..., go test ./...,
go test -tags lark ./..., go vet -tags lark ./..., Windows and Android
builds, GOOS=linux go vet ./....

Migration

Devices: wanctl start. Controllers: wanctl login. Agents already running are
unaffected. internal/portal/changelog/v0.8.1.md carries the same note for the
portal's release sheet.

🤖 Generated with Claude Code

https://claude.ai/code/session_01SpPAyRQzTAw7MbmJqZdm7e