test(cli): comprehensive test suite for manus-agent blast-radius subcommand

[manus-use]

Summary

Add a comprehensive CLI test suite for the manus-agent blast-radius subcommand.

_run_blast_radius and _build_blast_radius_parser were introduced in PR #63 (tool) and wired up as a CLI subcommand, but the execution layer had zero test coverage for the _run_blast_radius function. The existing test_dependency_blast_radius.py::TestCliParser only covers parser flag parsing — not the actual execution path, output generation, error handling, or main() dispatch.

What this adds

tests/test_cli_blast_radius.py — 52 tests across 13 suites:

Suite	Tests	What it covers
TestBuildBlastRadiusParser	9	Flag definitions, defaults, choices, required args, help text
TestRunBlastRadiusCveText	8	CVE spec → text output (rc=0, package name, blast label, summary, header, CVE ID in title, version range, downloads)
TestRunBlastRadiusCveJson	7	CVE spec → JSON output (rc=0, valid JSON, spec, cve_id, packages list, summary block, blast_radius field)
TestRunBlastRadiusPackageSpec	5	Direct package spec (requests@2.28.0, npm:lodash@4.17.20) — text + JSON, cve_id=null
TestRunBlastRadiusNoPackages	2	CVE with no packages found → rc≠0, error message printed
TestRunBlastRadiusMaxPackages	2	--max-packages limits _enrich_package call count and total_packages in JSON summary
TestRunBlastRadiusSorting	2	CRITICAL package sorted before LOW in both text and JSON output
TestRunBlastRadiusDeduplication	1	Same package from OSV + GHSA → _enrich_package called exactly once
TestRunBlastRadiusOptionalFields	3	description, latest_version, Maven full_id shown in text output when populated
TestRunBlastRadiusJsonTotals	2	total_weekly_downloads aggregated across packages; total_packages correct
TestSubcommandsRegistry	3	_SUBCOMMANDS membership, type, and exact string match
TestMainDispatchBlastRadius	5	main() routes blast-radius correctly; passes --output, --max-packages, package spec; propagates non-zero rc
TestRunBlastRadiusImportPath	3	Import sanity checks for _run_blast_radius, _build_blast_radius_parser, _SUBCOMMANDS

All tests are fully mocked — _fetch_nvd_affected, _fetch_osv_affected, _fetch_ghsa_affected, and _enrich_package are patched. No real HTTP calls.

Test counts

Before	After	Delta
1158	1210	+52

1210 passed, 3 deselected — full suite green.

No-duplicate confirmation

Checked against all open and recently merged PRs before building. The following open PRs were reviewed to confirm no overlap:

#51, #53, #54, #58, #60, #64, #65, #67, #74, #75, #76, #77, #78, #79, #80, #82, #83, #85, #86, #87, #88, #89, #90, #96, #98, #100, #103, #104, #105, #106, #107, #108, #109, #110, #111, #112, #113, #114, #115, #116, #117, #118, #119, #120

No open or merged PR covers _run_blast_radius execution tests.

The existing TestCliParser class in test_dependency_blast_radius.py only tests _build_blast_radius_parser (flag parsing), not the execution path. This PR is strictly additive — a new file, no changes to source code.