fix(manifest): include lazily-registered --help and --version flags

Cobra registers the default help and version flags during Execute, so a
command-tree walk performed before then omitted them. `vulnetix --version`
was therefore absent from docs/command-manifest.json, and the documentation
sites that validate their snippets against the manifest could not verify the
flag the install guides tell users to run.

Call InitDefaultHelpFlag/InitDefaultVersionFlag before walking, and document
the real global flag set (--verbose, --silent, --no-progress, --no-banner,
--no-analytics, --disable-memory, --version) in the CLI reference, with an
explicit note that --verbose is a diagnostic toggle and not a log level: the
CLI has no --debug flag and reads no DEBUG environment variable.

Author: 0x73746F66

cmd/manifest.go

@@ -49,6 +49,11 @@ var manifestCmd = &cobra.Command{
 // path with its flags. Persistent flags are attributed to the command that
 // declares them and to every descendant, because that is how a user sees them.
 func BuildCommandManifest() CommandManifest {
+	// Cobra registers --help and --version lazily during Execute, so a walk
+	// done before then would omit them from the manifest.
+	rootCmd.InitDefaultHelpFlag()
+	rootCmd.InitDefaultVersionFlag()
+
 	m := CommandManifest{Commands: map[string]ManifestCommand{}}
 	walkCommand(rootCmd, nil, &m)
 	return m

docs/command-manifest.json

@@ -4814,12 +4814,14 @@
       "short": "Vulnetix CLI - Automate vulnerability remediation",
       "flags": [
         "disable-memory",
+        "help",
         "no-analytics",
         "no-banner",
         "no-progress",
         "org-id",
         "silent",
-        "verbose"
+        "verbose",
+        "version"
       ],
       "subcommands": [
         "aibom",

website/content/docs/cli-reference/_index.md

@@ -899,10 +899,23 @@ Flags apply to the `auth login` command that *writes* a credential; they are not
 
 These flags are available on the root command and inherited by subcommands:
 
-| Flag | Type | Required | Default | Description |
-|------|------|----------|---------|-------------|
-| `--org-id` | string | No | stored | Organization ID (UUID); uses stored credentials if not set |
-| `--help` | - | No | - | Help for any command |
+| Flag | Type | Default | Description |
+|------|------|---------|-------------|
+| `--org-id` | string | stored | Organization ID (UUID); uses stored credentials if not set |
+| `-v, --verbose` | bool | `false` | Show verbose diagnostic output (rate limits, retries, cache status, auth notes) |
+| `--silent` | bool | `false` | Suppress all log output; print only the final result |
+| `--no-progress` | bool | `false` | Suppress progress indicators |
+| `--no-banner` | bool | `false` | Suppress the startup banner |
+| `--no-analytics` | bool | `false` | Disable anonymous usage analytics |
+| `--disable-memory` | bool | `false` | Disable `.vulnetix/memory.yaml` reads and writes |
+| `--version` | - | - | Print the version and exit |
+| `--help` | - | - | Help for any command |
+
+{{< callout type="info" >}}
+`--verbose` is **not** a log level — the CLI has no `--debug` flag and reads no `DEBUG` environment variable. It un-suppresses extra diagnostics on stderr. `--silent` suppresses info, status and warning output; errors and results are always printed.
+{{< /callout >}}
+
+`vulnetix --version` prints the bare version. `vulnetix version` prints the full report (commit, build date, and the versions of the bundled `malscan-engine`, `vdb-cyclonedx` and OPA modules).
 
 ## Environment Variables