fix: gstack-docs-candidate --help works; docs gate red lines name the denying tool failure

PR run 37239016858 ship-docsync-completion: the parent ran
'gstack-docs-candidate --help' (the helper's usage error points at --help, which
failed). That undeclared command made docsToolFailures non-empty, which denied
the atomic-replacement proof of the child's legitimate native Edit, so the red
line blamed the Edit's temp file. A replay of the capture proves the atomic
replace once --help is declared.

- the helper prints its usage for --help/-h and exits 0
- the fixture interface and command grammar admit the helper's bare --help
- the atomic-proof denial names its check and the tool failures behind it
  (deny labels renumbered to their lines)
- replay with negative controls (undeclared command, temp left behind, renamed
  elsewhere); diagnostic rerun of ship-docsync-completion passed

test/gstack-docs-candidate.test.ts

@@ -80,7 +80,7 @@ describe('gstack-docs-candidate', () => {
       ['snapshot', '--out', path.join(root, 'x.json'), '--audit-id', 'a', '--mode', 'write', '--base', 'main'],
       ['snapshot', '--out', path.join(root, 'y.json'), '--audit-id', 'a', '--mode', 'edit', '--base', 'no-such-rev'],
       ['snapshot', '--out', path.join(root, 'z.json'), '--audit-id', 'a', '--mode', 'edit', '--base', 'main', '--force', 'x'],
-      ['compare'], ['compare', path.join(root, 'missing.json')], ['install'],
+      ['compare'], ['compare', path.join(root, 'missing.json')], ['install'], ['--help', 'snapshot'],
     ]) {
       const result = run(dir, ...args);
       expect(result.status, args.join(' ')).toBe(1);
@@ -89,6 +89,15 @@ describe('gstack-docs-candidate', () => {
     expect(fs.existsSync(path.join(dir, 'inside.json'))).toBe(false);
   });
 
+  test('--help prints the usage it names in its errors', () => {
+    const { dir } = repo();
+    const help = run(dir, '--help');
+    expect(help.status, help.stderr).toBe(0);
+    expect(help.stdout).toContain('gstack-docs-candidate snapshot --out <candidate.json>');
+    expect(help.stdout).toContain('gstack-docs-candidate compare <candidate.json>');
+    expect(run(dir, 'install').stderr).toContain(help.stdout.trim());
+  });
+
   test('/ship records post-child hashes with the helper, so Step 16 compares instead of retyping', () => {
     // ci-37198445662 gate-census-2: ship-docsync-completion/-store parents spent 45-78 s of model time
     // retyping hash maps, child output and records into several artifacts after the child returned.