sec-base boots the full sec runtime before --help/--version and dies with a raw stack trace when unconfigured; the binary has no test #386

Evidence (origin/main ed971d3, built dist/libs-cli.js, Bun 1.4.2)

With no SEC_DB_* env and no .env.local:

$ bun dist/libs-cli.js --help      # also --version, task list
SecCliConfigurationError: SEC CLI is not configured; run `init` before commands like `bootstrap`.
      at assertSecCliEnvConfigured ...
      at async runWorkglowCli (@workglow/cli/dist/lib.js)
Bun v1.4.2

With the env set, the same commands work. So:

1. src/libs-cli.ts passes registerTasks: async () => { await bootstrapSecRuntime(); ... }, and runWorkglowCli calls it before commander parses, so --help, --version, init, credential, model all need a configured sec database. The sec binary avoids this via commandNeedsRuntime/isDiExemptCommand; sec-base has no equivalent.
2. src/libs-cli.ts re-throws primaryError, while src/sec.ts:47-58 prints a SecCliConfigurationError as one line. The repo rule is that an operator-fixable error reads as an instruction, not a crash. Here it prints a stack plus "Bun v1.4.2".
3. The message says to run init. In sec-base, init is workglow's own and does not write sec env; the remedy is sec setup.
4. No test references libs-cli/sec-base (grep -rn "sec-base\|libs-cli" src --include=*.test.ts finds one unrelated comment). checkPackedContents.ts asserts the file ships, nothing asserts it starts. This is the one binary that consumes libs' runWorkglowCli, so a libs bump can break it unseen.

Fix

• Make registerTasks lazy, or skip the bootstrap when the argv command is --help/--version/init/credential.
• Catch SecCliConfigurationError in libs-cli.ts as sec.ts does (one line, exit 1), naming sec setup.
• Add a subprocess test (the existing cli.integration.test.ts pattern) running the built or source libs-cli for --help, --version and task list with a temp pglite/sqlite env, plus the unconfigured case.

Acceptance

• sec-base --help and --version exit 0 with no sec env.
• Unconfigured sec-base task list prints one line naming sec setup, exit 1, no stack.
• A new test fails if libs-cli.ts stops booting.