pub fn build_afdata_cli(spec: CliSpec) -> Result<BuiltCliSpec, CliSpecError>Expand description
Build a registry under AFDATA’s naming conventions.
ArgSpec::sensitive is not an independent switch. AFDATA already decides
what a secret is by the _secret suffix, and the same convention drives
config keys, log fields, and redaction. Deriving the bit from the argument
id keeps one source of truth: an argument cannot be sensitive to the parser
while staying invisible to redaction downstream. Marking a differently named
argument sensitive is the reverse mistake, so it fails the build instead of
silently diverging.