docs(contract): propose §7 Hermeticity for --help and flag-validation

Adds a new §7 Hermeticity section to CONTRACT.md codifying the property
that compat/dates and compat/formats already enforce as a harness
invariant: a CLI's --help path and any flag-validation failure must make
no network requests. Without this section the contract is silent on a
property all three exporters already satisfy, and the harness language
has to describe itself as defending something the contract does not
promise — a gap that invites both new-author confusion and reviewer
pushback on the harness.

- Insert §7 Hermeticity between §6 prime and the former §7 Conformance.
- Renumber Conformance §7 → §8 and Versioning §8 → §9.
- Update §8 Conformance bullets to cite §7 instead of "harness invariant".
- Add Status table row "Hermetic --help / flag-validation" with machine
  attestation across all three exporters via compat/dates and
  compat/formats.

Resolves the proposal half of QUA-22. Follow-up edits to restore honest
§7 citations in compat/dates/dates.go and compat/formats/formats.go are
tracked separately (one-line comment updates after this lands).

--version is intentionally left out of §7 scope: it is not yet covered
by any compat bundle, and per the "document at N=2 not N=1" rule we
shouldn't have CONTRACT.md promise something the harness doesn't pin
down. Inclusion later is non-breaking.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

Author: LeadGoEngineer

CONTRACT.md

@@ -24,6 +24,7 @@ Each cell shows whether the section is implemented and how it is attested for th
 | `--format csv` | — | — | human |
 | `auth status` subcommand | human | human | human |
 | `prime` subcommand | human | human | human |
+| Hermetic `--help` / flag-validation (§7) | **machine** | **machine** | **machine** |
 
 All implemented sections shipped across all three CLIs (April 25, 2026). The table is per-cell rather than per-row so partial-codec adoption (e.g. crono/liftoff implementing markdown+json but not csv) is visible without losing fidelity. Cells marked "human" are candidates for promotion to **machine** as the compat library grows and exporters wire it in via `compat.Runner.SupportedFormats`.
 
@@ -109,16 +110,24 @@ GOTCHAS       non-obvious pitfalls
 
 Prime is short. It is not a man page. If it grows past one terminal screen, something belongs in this contract instead.
 
-## 7. Conformance (the compat library)
+## 7. Hermeticity
+
+A `--help` invocation and any flag-validation failure that exits non-zero before subcommand work begins must make no network requests. This lets an LLM agent or an offline user introspect the CLI — discover what it does and how to call it — without an authenticated session or a working network.
+
+The [`compat/`](compat/README.md) library pins this down on every PR by running the `--help` path and the flag-parse-failure path under a no-network environment.
+
+Out of scope: subcommands that do real work (`auth status`, `prime`, data subcommands) — by construction they need network access, and this section does not constrain them. `--version` is not yet specified here; it is a candidate for a future revision once a compat test pins it down.
+
+## 8. Conformance (the compat library)
 
 Conformance to this contract is verified by [`compat/`](compat/README.md), a small black-box Go test library that lives in this repo and is imported by every `*-export-cli` from its own CI. The current bundles:
 
-- [`compat/dates`](compat/README.md) — pins down §3: that `--since` / `--until` are documented in `--help`, and that an invalid value exits non-zero with a stderr-only error. The bundle additionally asserts that `--help` and flag-validation failures make no network request — that is a harness invariant the framework defends on every PR, not a property §3 itself promises.
-- [`compat/formats`](compat/README.md) — pins down §4: that `--format` is documented, an unknown value exits non-zero with a stderr-only error, `--format json` emits a parseable JSON array, `--format csv` emits at least a header row, and the default is byte-identical to `--format markdown`. The `--format` parse-failure path is hermetic on the same harness-invariant basis as the dates bundle.
+- [`compat/dates`](compat/README.md) — pins down §3: that `--since` / `--until` are documented in `--help`, and that an invalid value exits non-zero with a stderr-only error. The bundle also pins down [§7](#7-hermeticity) for both the `--help` path and the date-parse-failure path.
+- [`compat/formats`](compat/README.md) — pins down §4: that `--format` is documented, an unknown value exits non-zero with a stderr-only error, `--format json` emits a parseable JSON array, `--format csv` emits at least a header row, and the default is byte-identical to `--format markdown`. The bundle additionally pins down [§7](#7-hermeticity) for the `--format` parse-failure path.
 
 A new exporter is not "in" the family until its CI runs at least the `dates` bundle green. The `formats` bundle ships with a `Runner.SupportedFormats` affordance so partial-codec exporters can adopt it without an immediate `--format csv` failure: declare the codecs you actually implement and the bundle skips codec-specific subtests for the rest. Each exporter's per-codec cells in the Status table flip from `human` to **machine** as it wires the bundle in; codecs not yet implemented stay at `—` until the writer lands.
 
-## 8. Versioning and releases
+## 9. Versioning and releases
 
 Semantic versioning. User-visible bug fix → patch. New subcommand or flag → minor. Removed/renamed flag → major. Releases cut via `gh release create` against the relevant tag; goreleaser builds binaries for darwin/linux/windows × amd64/arm64 and publishes the cask to `quantcli/homebrew-tap`.