test(01-04): cover tool, output, watch loop and workspace modules

- Non-TTY widgets/prompts, flag parsing, secret non-leak and malicious IDs
- Real hello workspace rebuild latency line, debounce and ignored bin/tmp
- scripts/check-phase1.sh runs vet/test/race across root, hello, base, greeter, optional

examples/hello/hello_test.go

@@ -104,6 +104,15 @@ func TestBuiltBinaryGreeterHello(t *testing.T) {
 	assertGreeting(t, got, want)
 }
 
+func TestBuiltBinaryUnknownCommandExitsNonZero(t *testing.T) {
+	runSummerBuild(t)
+	cmd := exec.Command("./bin/hello", "does:not-exist")
+	out, err := cmd.CombinedOutput()
+	if err == nil {
+		t.Fatalf("expected non-zero exit, output:\n%s", out)
+	}
+}
+
 func assertGreeting(t *testing.T, got, want string) {
 	t.Helper()
 	if !strings.Contains(got, "plugin\tstatus") || !strings.Contains(got, "golem15.greeter\tactive") {