#4295 fix(cli): put the error before the diagnostics footer on failures

Summary

Failed device commands print a diagnostics footer (Diagnostics Log / Diagnostic ID) after the error, and agents habitually pipe through tail -n 2 — which keeps the footer and cuts the actual error. One audited session blind-retried six times that way; another lost 38 deployed report images to the same blind spot. The CLI now puts the error first and single-line on failures and moves the diagnostics footer behind --verbose, so truncation from the tail can no longer hide the cause. JSON output shape is unchanged.

9 files changed (failure output ordering across the command output layer, tests).

Validation

• Head: 74d498bbe on a68693c72 (includes review-fix commit).
• pnpm run typecheck, pnpm run lint, output-layer and schema tests, integration-progress --check, fallow, freerange: pass locally.
• Independent cold review: applied. CI runs the full gates on push.

🤖 Generated with Claude Code

---

^{Open in [code]smith · Need help on this PR? Tag @codesmith-bot with what you need.}