chore(assistant): trim contacts CLI per #30281 review (drop guardian-only help paragraph + remove contacts merge)

[vellum-apollo-bot]

Follow-up to #30281 addressing your two review threads.

Review threads addressed

1. assistant/src/cli/commands/contacts.ts:176 — "Delete this comment"

   Drops the four-line Contact writes are guardian-only and happen through the assistant web UI / Contacts tab / invite flow ... paragraph I had added to the parent contacts command's help text. Help stays terse; the available subcommands speak for themselves.

2. assistant/src/cli/commands/contacts.ts:181 — "Delete this cli next" (pointing at $ assistant contacts get abc-123)

   Removes the assistant contacts get <id> CLI subcommand entirely (~50 lines: Commander definition, addHelpText, the cliIpcCall("getContact", ...) action). Continuing the trim of guardian-only contact CLI surface — list + the LLM-side contact_search already cover ID-resolution needs.

Changes

• assistant/src/cli/commands/contacts.ts:
  • Drop the explanatory paragraph + $ assistant contacts get abc-123 example line from the parent contacts addHelpText block.
  • Delete the entire contacts.command("get <id>") subcommand.
  • Update the channelId argument note in the channels update-status help text to point at assistant contacts list --json instead of the (now removed) assistant contacts get <contactId>.
• gateway/src/risk/command-registry/commands/assistant.ts:
  • Drop contacts get from the allowlist. No risk-classification entry existed (reads weren't classified medium-risk), so this is the only registry change.

What does NOT change

• Internal getContact callers in the store and HTTP routes (gateway + assistant inbox views, contact-prompt routing, etc.) — those are not CLI-exposed.
• LLM-facing skill tools contact_search / contact_merge / google_contacts (unchanged).
• contacts list, contacts merge, contacts prompt, contacts channels …, contacts invites … CLI subcommands (unchanged).

Diff

 assistant/src/cli/commands/contacts.ts             | 59 +---------------------
 gateway/src/risk/command-registry/commands/assistant.ts |  1 -
 2 files changed, 1 insertion(+), 59 deletions(-)

Verification

• bun run lint + bun run typecheck clean on both assistant/ and gateway/. CLI inventory check passes (44 commands ↔ 44 inventory rows).
• bun test contacts-tools.test.ts contacts-write.test.ts → 11/11 pass.
• bun test bash-risk-classifier.test.ts → 10/10 pass.
• grep "contacts get" clean across the repo afterwards.

---

[linear]

ATL-311

[devin-ai-integration]

Devin Review found 2 potential issues.

⚠️ 2 issues in files not directly in the diff

⚠️ Shell completions still offer removed get subcommand for contacts (assistant/src/cli/commands/completions.ts:45)

The contacts get command was removed in this PR, but assistant/src/cli/commands/completions.ts:45 still lists "get" in the contacts completions array. Users who Tab-complete assistant contacts will see get as a valid option, but the command no longer exists. This violates the Deprecation Hygiene rule in assistant/src/cli/AGENTS.md which requires updating all string references to removed commands.

---

⚠️ COMMAND_INVENTORY.md still lists removed get subcommand and getContact operation ID (assistant/src/cli/COMMAND_INVENTORY.md:55)

The contacts get command was removed in this PR, but assistant/src/cli/COMMAND_INVENTORY.md:55 still lists get in the Subcommands column and getContact in the Operation IDs column for the contacts row. This violates the Deprecation Hygiene rule in assistant/src/cli/AGENTS.md: "Update references — search for string references to the old command in docs, skills, fixtures, help text, and comments. Update or remove them." The COMMAND_INVENTORY.md is CI-validated by check-cli-inventory.ts, so this stale entry may also cause CI failures.

View 2 additional findings in Devin Review.