fix(cli): suggest current namespace in pack remediation messages

[SequeI]

Linked Issue

Closes #1634

Summary

A profile can still reference an official pack by a namespace it was published under before a registry rename (e.g. always-further/claude, now nolabs-ai/claude). Every nono pull .../nono remove ... remediation message in verify_profile_packs echoed the stale namespace straight back instead of the one that still resolves, across six separate error paths (not-installed, missing lockfile entry, missing artifact, tampered artifact, missing trust bundle, signer mismatch).

separate error paths (not-installed, missing lockfile entry, missing artifact, tampered artifact, missing trust bundle, signer mismatch).

Add package_status::canonicalize_legacy_pack_ref(), reusing the existing legacy_namespaces table, and route every remediation message through it. Also add a proactive warning when a legacy-namespace pack is loaded at all, even when its otherwise healthy, so users learn to migrate before something breaks rather than only after.

No automatic migration is performed and the users own profile is never modified — this only fixes what nono tells them to run.

Test Plan

Checklist

• An issue exists and is linked above
• All commits are signed-off, using DCO
• All new code follows the project's coding standards (CLAUDE.md) and is covered by tests
• Public-facing changes are paired with documentation updates

[github-actions]

PR Review Summary

Size

Metric	Value
Lines added	+160
Lines removed	-18
Total changed	178
Classification	Medium (50–300 lines)

Affected crates

• crates/nono-cli — CLI changes. Verify argument parsing, flag documentation, and UX behaviour across supported platforms.

Blast radius — Contained

This PR touches: source code

---

_{Updated automatically on each push to this PR.}

[nogent-nolabs-ai]

nogent code review

1 design concern regarding incomplete profile migration remediation guidance.

Findings (not tied to a changed line):

• 🔒 [HIGH · security] crates/nono-cli/src/package_status.rs:105 — The yanked-pack and security advisory enforcement in enforce_official_pack_status looks up the locked package exclusively using its current canonical key (nolabs-ai/claude). If a legacy pack is registered in the lockfile under a retired namespace (such as always-further/claude), lockfile.packages.get(&key) returns None. This silently bypasses the official pack status check, allowing potentially yanked or vulnerable legacy versions of the pack to be loaded and run without any security enforcement. Fix this by checking all possible namespaces/keys for the target using target.keys().find_map(|k| lockfile.packages.get(&k)).
• 🐛 [LOW · bug] crates/nono-cli/src/profile/mod.rs:3020 — The remediation hint Use 'nono pull {}' to install it instead. uses the raw, uncanonicalized pack reference. If a legacy/retired namespace is used, this will guide the user to pull from the stale/unresolvable namespace. Wrap the reference in canonicalize_legacy_pack_ref to ensure the correct canonical namespace is suggested.
• 🐛 [LOW · bug] crates/nono-cli/src/output.rs:1309 — The command recommendation nono pull {pack_ref} uses the raw pack_ref which may be a retired legacy namespace. For parity with the other CLI remediation messages, pass the reference through canonicalize_legacy_pack_ref before formatting the output.

_{Automated code + security review. CI already covers clippy, rustfmt, tests, cargo-audit and commit-lint.}

[connrg]

lgtm