CLI help: explain piped and file input for sotto set #596

The problem

sotto set --help lists the hidden prompt, --value and --stdin, but gives no examples or explanation of how piped input is handled. In particular, --stdin reads every byte through EOF without trimming: using echo can unintentionally store a trailing newline, while redirecting a file stores its complete contents as one value.

Make these existing input modes understandable from command help, so users can choose the right one without reading read_value().

Proposed approach

Add a short input explanation and examples to the Set subcommand help, following the existing Get, Import, History and Run help patterns.

Acceptance criteria

• Show sotto set DATABASE_URL for the hidden prompt and sotto set PRIVATE_KEY --stdin < ./example-key.txt for file input. Explain that file input stores one complete value rather than importing dotenv assignments.
• Include a clearly synthetic POSIX pipeline example, such as printf '%s' 'example-value' | sotto set EXAMPLE --stdin, and explain why printf avoids the extra newline commonly added by echo. Do not present inline literal examples as a way to keep real credentials out of shell history.
• Explain that --stdin reads until EOF and preserves bytes, including line endings and trailing newlines; it does not trim or interpolate the input.
• Retain the warning that --value can expose a real credential in shell history/process arguments, and explain that --value and --stdin cannot be combined.
• Clarify that choosing stdin replaces the value prompt, not initialisation or unlock requirements. For piped use, prepare/unlock the local store beforehand rather than suggesting a machine token grants write access.
• Check rendered sotto set --help for readable formatting and valid examples. If adding a help regression test, use the existing Cli::command() pattern and assert the essential input guidance without snapshotting the entire help output.

Evidence and starting points

Source-inspected current main 07237e2b3f817f342f6981a55b501487cc3a59e8 in a clean isolated checkout on macOS arm64:

• crates/cli/src/main.rs: Command::Set has no after_help examples; read_value() uses read_to_end without trimming for stdin; the command calls ensure_unlocked() before reading its value.
• Nearby import_help_explains_literal_and_quoted_values and history_and_rollback_help_explain_versions tests demonstrate rendering subcommand help without a real vault or server.

This is a help/documentation gap, not a reported input-processing bug. No real secret was supplied or stored. Open and closed issues and open PRs were checked; #208 covered dotenv import syntax, while this task explains the separate single-value set command.

Keep this contribution to help text and any focused help assertion. Do not change byte handling, validation, prompting, storage or encryption. Follow British English conventions and sign off commits with git commit -s.