Address review feedback on upgrade CLI

- Reject --check-upgrades together with --format mcpservers: that format
  has no upgrade column, so the combination performed a registry lookup
  per workload and discarded the result. Fail loudly in PreRunE instead.
- Guard the bulk-result loop against nil entries so it stays robust if
  CheckAll's contract ever changes.
- Drop the network-isolation line from the posture-drift report; the
  checker no longer reports it (the registry has no such field).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: JAORMX

cmd/thv/app/list.go

@@ -62,9 +62,23 @@ func init() {
 	listCmd.PreRunE = chainPreRunE(
 		validateGroupFlag(),
 		ValidateFormat(&listFormat, FormatJSON, FormatText, "mcpservers"),
+		validateCheckUpgradesFormat(),
 	)
 }
 
+// validateCheckUpgradesFormat rejects --check-upgrades with --format mcpservers.
+// The mcpservers format emits client configuration and has no upgrade column, so
+// the flag combination would perform a registry lookup per workload and then
+// discard the result. Fail loudly rather than do hidden, wasted work.
+func validateCheckUpgradesFormat() func(*cobra.Command, []string) error {
+	return func(_ *cobra.Command, _ []string) error {
+		if listCheckUpgrades && listFormat == "mcpservers" {
+			return fmt.Errorf("--check-upgrades is not supported with --format mcpservers; use --format text or json")
+		}
+		return nil
+	}
+}
+
 func listCmdFunc(cmd *cobra.Command, _ []string) error {
 	ctx := cmd.Context()
 

cmd/thv/app/upgrade.go

@@ -175,6 +175,11 @@ func printUpgradeTable(results []*upgrade.CheckResult) {
 	}
 
 	for _, r := range results {
+		if r == nil {
+			// CheckAll does not return nil entries today; guard so this stays
+			// robust if that ever changes.
+			continue
+		}
 		if _, err := fmt.Fprintf(w, "%s\t%s\t%s\t%s\t%d\t%s\n",
 			r.WorkloadName,
 			r.Status,
@@ -229,9 +234,6 @@ func printUpgradeDetail(r *upgrade.CheckResult) {
 		if c := r.ConfigDrift.Transport; c != nil {
 			fmt.Printf("  ⚠ transport: %s -> %s\n", c.From, c.To)
 		}
-		if c := r.ConfigDrift.NetworkIsolation; c != nil {
-			fmt.Printf("  ⚠ network isolation: %t -> %t\n", c.From, c.To)
-		}
 		if c := r.ConfigDrift.PermissionProfile; c != nil {
 			fmt.Printf("  ⚠ permission profile: %s -> %s\n", c.From, c.To)
 		}