[P2] flag-parsing & dispatch/usage/completions drift roundup

[gfargo]

Problem

Several commands mis-handle flags in positional slots or silently drop them, and the dispatch table has drifted from usage text and the completion scripts.

Evidence — flag parsing

• audit <host> --sudo: --sudo is captured as a positional (VPS_USER/key/port) because positionals are assigned before flags are filtered (strut:663-674). strut audit myhost --sudo SSHes as user --sudo.
• migrate <host> --yes: vps_user="${2:-ubuntu}" is never cleaned (only ssh_port/ssh_key are, migrate.sh:82-86) → ssh --yes@host. Same for --sudo/--stack=/--start-phase= in slot 2.
• group <name> logs --env <e>: _group_logs has no --env case (cmd_group.sh:222-234) → the flag and its value are dropped; children run against the default env.
• cert:renew --host <alias>: usage advertises --host (strut:323) but it's consumed by parse_common_flags and re-injected only for gateway/adopt → cmd_cert never sees it.

Evidence — dispatch/usage/completions

• Dispatched but missing from usage(): validate, history, logs:download, logs:rotate, drift images (strut:280 also omits drift images).
• Completions offer five nonexistent keys subcommands (rotate status check env ssh github — completions/{bash,zsh,fish}), omit drift images, and never complete gateway (a first-word virtual stack). test_completions_sync.bats only checks top-level/per-stack names, so this is invisible to CI.
• Bare .env is completed as env name prod (bash.sh:47 et al.), but --env prod resolves strictly to .prod.env (strut:482); the TUI already skips bare .env.

Fix

Filter --* args out before positional assignment in audit/migrate; add --env to _group_logs; fix cert --host (re-inject or correct usage); regenerate completion subcommand word-lists from the handlers and extend test_completions_sync.bats to cover subcommands + gateway; add the missing usage lines.

Acceptance

• audit/migrate accept flags in any position; group logs --env targets the right env; completions match the dispatch (enforced by a sync test).

---

Filed from the 2026-07-12 full-codebase audit (docs/AUDIT-2026-07-12.md).