Fixes CLI-1488: the Go proxy layer was silently falling back to
`"supabase"` on PATH when the `supabase-go` binary could not be
resolved. When the shim itself is on PATH and `supabase-go` is not
co-located, this fallback resolves to the shim and causes a fork-bomb
(silent multi-minute hang in CI followed by SIGTERM).

## Changes

- **Binary resolution**: `resolveBinary()` now returns a
`BinaryResolution` discriminated union (`{ found: string } | { notFound:
string[] }`) instead of a fallback string. The `notFound` variant tracks
all attempted locations for user-facing diagnostics.

- **Error handling**: When binary resolution fails, `makeGoProxyLayer`
now prints a specific diagnostic message to stderr and exits with code 1
via `ProcessControl.exit()`, rather than attempting to spawn a
non-existent binary.

- **User-facing diagnostics**: New `formatGoBinaryNotFoundError()`
function generates a helpful error message that:
  - Lists all locations the resolver checked
- Provides platform-specific `curl | tar` install snippets (when
CLI_VERSION is not the dev sentinel and the host architecture is
supported)
- Suggests npm installation and SUPABASE_GO_BINARY environment variable
as alternatives

- **Test coverage**: Added comprehensive unit tests for
`formatGoBinaryNotFoundError()` covering:
  - Basic error message formatting with all attempted locations
  - Dev build behavior (no curl snippet when CLI_VERSION is "0.0.0-dev")
- Platform-specific snippet generation (linux x64, darwin arm64, win32 →
windows mapping)
- Unsupported architecture handling (no snippet when release asset
doesn't exist)
- Integration test verifying the layer refuses to spawn and exits 1 when
binary is not found

The fix ensures the CLI fails fast with actionable guidance instead of
silently fork-bombing itself.

https://claude.ai/code/session_01Lb1v3o9Dabe6qjH565ki4k

---------

Co-authored-by: Claude <noreply@anthropic.com>

Refactor the hidden flag system to scope flag visibility per-command
rather than maintaining a global registry. This prevents flag name
collisions when the same flag name appears in different commands with
different visibility requirements.

## Changes

- **Replaced global hidden flag registry with per-command annotations**:
Changed from a module-level `Set<string>` to a `Context.Reference`
(`LegacyHiddenFlags`) that attaches hidden flag metadata directly to
each `Command` via `Command.annotate`.

- **Introduced `withHiddenFromConfig` helper**: New pipe step that walks
a command's flag config, collects all flags wrapped with `withHidden`,
and attaches the resulting set to the command. This materializes the
per-command list at command construction time, scoping visibility to
that specific command.

- **Updated `withHidden` to use WeakMap tracking**: Changed from adding
to a global set to recording flag references in a module-local
`WeakMap`, allowing `withHiddenFromConfig` to look up which flags were
marked hidden without polluting global state.

- **Updated `stripHiddenFlagsFromHelpDoc` to read from annotations**:
Now reads the hidden flag set from the help doc's `LegacyHiddenFlags`
annotation instead of checking a global registry, enabling per-command
filtering.

- **Applied `withHiddenFromConfig` to all legacy commands**: Updated
`stop`, `start`, `init`, `functions deploy`, `functions download`, and
`functions serve` commands to wire their configs through
`withHiddenFromConfig`.

- **Added `--backup` hidden flag to stop command**: Restored the
historical `--backup` flag (hidden by default) for Go CLI parity, with
handler logic to forward `--backup=false` when explicitly disabled.

- **Added integration test for stop command**: New test file validates
that the `--backup` flag is correctly forwarded to the Go proxy.

## Implementation Details

The refactor maintains backward compatibility with the existing
`withHidden` API while fixing the architectural issue where flags with
the same name in different commands would interfere with each other. The
`Context.Reference` pattern ensures each command carries its own
isolated set of hidden flag names, read during help doc rendering.

Related: CLI-1483

https://claude.ai/code/session_01EB93upyjdFDB3czXheQknG

Co-authored-by: Claude <noreply@anthropic.com>