chore(gates): register the host command and its TLS flags

Add `host` to the reviewed device-claim policy set, give the
--tls-cert/--tls-key flags their own Host bucket in the integration
progress model, list `hostCommand` with the dynamically loaded CLI handlers
in the fallow production exemptions, and waive the operator-facing `host`
help topic from the help benchmark.

Author: vkuprin

.fallowrc.json

@@ -221,7 +221,7 @@
     },
     {
       "comment": "Dedicated CLI command handlers are reached only through the dynamic `import()` table `dedicatedCliCommandHandlerLoaders` in src/cli/commands/router.ts, which --production analysis cannot follow to a consumer. Same shape as the daemon route-handler entry above; that table is what enumerates this list, so add/remove here whenever a loader is added/removed.",
-      "file": "src/cli/commands/{auth,connection,daemon,device,plugins,proxy,recording,replay,screenshot,takeover}.ts",
+      "file": "src/cli/commands/{auth,connection,daemon,device,host,plugins,proxy,recording,replay,screenshot,takeover}.ts",
       "exports": [
         "authCommand",
         "pluginsCommand",
@@ -230,6 +230,7 @@
         "connectionCommand",
         "daemonCommand",
         "deviceCommand",
+        "hostCommand",
         "proxyCommand",
         "recordingCommand",
         "replayCommand",

packages/command-registry/src/__tests__/device-claim-policy.test.ts

@@ -61,6 +61,7 @@ test('every command that deviates from require-owner is a reviewed, diffable set
       'daemon',
       'debug',
       'disconnect',
+      'host',
       'human_control',
       'install-from-source',
       'lease_allocate',

scripts/__tests__/help-conformance-topic-coverage.test.ts

@@ -12,6 +12,7 @@ const WAIVED_TOPICS: Record<string, string> = {
   cdp: 'JS-heap forensics niche; add cases when heap-guidance regressions show up in practice.',
   commands:
     'Derived command/configuration reference, not a planning loop; catalog completeness is structurally tested.',
+  host: 'Operator setup for the Host front-end, not a planning loop; no worker-planning case is defined yet.',
   macos: 'macOS surface guidance is thin and stable; no observed planning regressions yet.',
   maestro: 'Compatibility reference, not a planning loop; conformance is oracle-tested instead.',
   'physical-device': 'Needs device-specific setup guidance; no portable planning task defined yet.',

scripts/integration-progress-model.ts

@@ -332,6 +332,11 @@ function summarizeProviderScenarioFlagExclusions() {
         'stale',
       ],
     },
+    {
+      name: 'Host front-end TLS options',
+      owner: 'Host server tests (src/cli/host/host-server.test.ts)',
+      keys: ['hostTlsCert', 'hostTlsKey'],
+    },
     {
       name: 'daemon lifecycle control',
       owner: 'daemon CLI lifecycle tests',