5c35f8349e
Address the friction in #760 where Code Agent picked <pod>:workspace:/ keil download/flash and <pod>:debug-probe flash for firmware flashing, all of which are not SOP. Add to SKILL.md: - Selector Cheat Sheet: explicit per-surface allowed operations table - Common selector mistakes table: wrong selector -> error you would hit -> correct selector - Pitfalls Observed in Real Runs: --reason required for build/download even on read-only sub-actions, cloud-api job output is empty for build/download, workspace rg --pattern shell-pipe collision In tools/src/device-pod-cli-lib.ts: - workspace.keil now fail-fasts on any action that is not add-source or remove-source, with code unsupported_workspace_keil_action and a selector hint pointing to debug-probe download start - debug-probe flash now has a dedicated error code path with the same selector hint instead of the generic unsupported_debug_operation - catch-all debug-probe error message now includes the allowed list - help() payload exposes a selectorCheatSheet array so hwpod --help callers see the SOP table without reading the SKILL.md file Tests in tools/device-pod-cli.test.ts: 6 new cases lock in the new error codes, the selector cheat sheet, and that add-source still dispatches correctly. 26/26 pass.