stave features

Report Stave's capability scope.

IN SCOPE is discovered live from this build's registries (control
catalog, packs, compliance frameworks, observation schemas, ATT&CK
tactics) — it cannot drift from what the binary can actually do. OUT OF
SCOPE is read from the versioned features/scope.yaml manifest, which is
reviewed in PRs: capabilities Stave delegates to upstream collectors or
downstream tools.

Inputs:
  --format, -f   Output format: text (default) or json.

Outputs:
  stdout         The scope report (text table or JSON).

Exit codes:
  0  report rendered
  2  invalid flag / unknown format
  4  internal error reading the embedded manifest

Examples:
  stave features
  stave features --format json

Usage:
  stave features [flags]

Examples:
  stave features
  stave features --format json

Flags:
  -f, --format string   Output format: text or json (default "text")
  -h, --help            help for features

Global Flags:
      --allow-symlink-output   Allow writing output through symlinks (default: refuse)
      --force                  Allow overwriting existing output files
      --log-file string        Write logs to file (default: stderr)
      --log-format string      Log format: text|json (default "text")
      --log-level string       Log level: debug|info|warn|error (overrides -v)
      --log-timestamps         Include timestamps in logs (breaks determinism)
      --log-timings            Include timing information (breaks determinism)
      --no-color               Disable ANSI colors in output
      --path-mode string       Path rendering in errors/logs: base (basename only) or full (absolute paths) Resolved default may come from STAVE_* env vars, stave.yaml, user config, or built-in.
      --quiet                  Suppress output (exit code only) Resolved default may come from STAVE_* env vars, stave.yaml, user config, or built-in.
      --require-offline        Assert offline operation: fail if proxy env vars (HTTP_PROXY, HTTPS_PROXY, ALL_PROXY) are set
      --sanitize               Sanitize infrastructure identifiers (bucket names, ARNs, policies) from output Resolved default may come from STAVE_* env vars, stave.yaml, user config, or built-in.
      --strict                 Enable strict integrity checks for embedded registries and references
  -v, --verbose count          Increase verbosity (-v=INFO, -vv=DEBUG)
  -y, --yes                    Auto-confirm all interactive prompts (distinct from --force which controls file overwriting)