fix: correct doc-code inconsistencies found by cross-reference review

Check 1 (Absolute Claims):
- Scoped "all other code" to "programmatic consumers" and listed
  --help text as an exception alongside cleanupFiles.ts

Check 7 (Doc-Code Sync):
- cloneRepo: added fetch tags step and onProgress param to table
- installPackages: documented custom-mode fallback to pnpm i
- cleanupFiles: added onProgress param to table
- Validation order: added step 7 (empty-after-parse check)
- Security: stderr is piped (not suppressed) for error diagnostics
- AGENTS.md: semicolons are asNeeded not no, trailing commas are
  all not none, mocking pattern includes exec.test.ts spawn mock

Author: fernandomg

AGENTS.md

@@ -26,10 +26,10 @@ A CLI installer tool for dAppBooster projects. It supports two modes:
 
 ## Code Style
 
-- **Semicolons:** no
+- **Semicolons:** as needed (Biome `asNeeded` — omitted unless required by ASI)
 - **Quotes:** single
 - **Print width:** 100
-- **Trailing commas:** none (Biome default)
+- **Trailing commas:** all (Biome default)
 - **Indent:** spaces, width 2
 - **Imports:** explicit `.js` extensions (ESM, `"type": "module"`)
 
@@ -64,7 +64,7 @@ Key directories:
 - **Structure:** `source/__tests__/` mirrors `source/` layout. Operations tests live in `source/__tests__/operations/`
 - **What to test:** Non-interactive agentic flow (validation, JSON output), operations (correct shell commands), config, utils
 - **What not to test:** React/Ink components
-- **Mocking pattern:** Operations tests mock `exec`/`execFile` from `source/operations/exec.js`. Non-interactive tests mock the entire operations layer
+- **Mocking pattern:** Operations tests mock `exec`/`execFile` from `source/operations/exec.js`. `exec.test.ts` mocks `child_process.spawn` directly to test the helpers themselves. Non-interactive tests mock the entire operations layer
 - **Coverage:** Focus on the agentic interface. Test files and `source/components/` are excluded from coverage
 
 ## Guardrails

architecture.md

@@ -75,18 +75,18 @@ featureDefinitions: Record<FeatureName, {
 
 `featureNames` is derived as `Object.keys(featureDefinitions)`.
 
-When adding a new feature, add it here. All other code (validation, cleanup, info output, TUI selection) picks it up automatically — except `cleanupFiles.ts` which needs explicit cleanup rules.
+When adding a new feature, add it here. Programmatic consumers (validation, info output, TUI selection) pick it up automatically — except `cleanupFiles.ts` (which needs explicit cleanup rules) and the CLI `--help` text in `cli.tsx` (which maintains its own copy).
 
 ### Operations Layer (`source/operations/`)
 
 Plain async functions with no UI dependencies. Each operation receives explicit arguments (project folder, mode, features) and performs file system or shell work. Multi-step operations accept an optional `onProgress` callback that the TUI uses to render per-step progress; the non-interactive path omits it.
 
 | Function | What it does |
 |---|---|
-| `cloneRepo(projectName)` | Shallow clone, checkout latest tag, rm .git, git init. Uses `execFile` (no shell) for all commands except `git checkout $(...)` which needs shell substitution. |
+| `cloneRepo(projectName, onProgress?)` | Shallow clone, fetch tags, checkout latest tag, rm .git, git init. Uses `execFile` (no shell) for all commands except `git checkout $(...)` which needs shell substitution. |
 | `createEnvFile(projectFolder)` | Copy .env.example to .env.local |
-| `installPackages(projectFolder, mode, features)` | Full: `pnpm i`. Custom: `pnpm remove` deselected packages + postinstall. Uses `execFile` exclusively (no shell). |
-| `cleanupFiles(projectFolder, mode, features)` | Remove files/folders for deselected features, patch package.json scripts, remove .install-files. Uses `execFile` exclusively (no shell). |
+| `installPackages(projectFolder, mode, features, onProgress?)` | Full: `pnpm i`. Custom with packages to remove: `pnpm remove` + postinstall. Custom with all features: `pnpm i`. Uses `execFile` exclusively (no shell). |
+| `cleanupFiles(projectFolder, mode, features, onProgress?)` | Remove files/folders for deselected features, patch package.json scripts, remove .install-files. Uses `execFile` exclusively (no shell). |
 
 ### Shell Execution (`source/operations/exec.ts`)
 
@@ -122,10 +122,11 @@ default  →  dynamic import ink + App → TUI
 2. `--mode` required
 3. `--name` matches `/^[a-zA-Z0-9_]+$/`
 4. `--mode` is `full` or `custom`
-5. Full mode: skip to step 8 (features ignored, all installed)
+5. Full mode: skip to step 9 (features ignored, all installed)
 6. `--features` required for custom mode
-7. All feature names are valid keys in `featureDefinitions`
-8. Project directory does not already exist
+7. Parsed features list is non-empty (rejects trailing commas, whitespace-only entries)
+8. All feature names are valid keys in `featureDefinitions`
+9. Project directory does not already exist
 
 **Non-interactive execution order:**
 `cloneRepo` → `createEnvFile` → `installPackages` → `cleanupFiles` → success JSON
@@ -188,4 +189,4 @@ Steps 1 and 4 are always required. Steps 2-3 only apply if the feature has files
 - User input (`projectName`) is validated against `/^[a-zA-Z0-9_]+$/` before any use
 - Operations use `execFile` (no shell) for commands that include user input
 - `exec` (shell) is reserved for commands needing shell substitution, and never receives user input in the command string
-- Non-interactive output suppresses child process stdout/stderr to guarantee clean JSON on stdout
+- Child process stdout is ignored and stderr is piped (captured for error diagnostics only), guaranteeing clean JSON on the parent's stdout