fix(cli): use cobra mutual-exclusivity template in sso add

[Coly010]

What changed

sso add emitted a hand-written mutual-exclusivity error (only one of --metadata-file or --metadata-url may be set) and detected the conflict via Option.isSome on parsed flag values. The Go CLI enforces this group via cobra's MarkFlagsMutuallyExclusive("metadata-file", "metadata-url") (apps/cli-go/cmd/sso.go:164), whose error template is:

if any flags in the group [metadata-file metadata-url] are set none of the others can be; [metadata-file metadata-url] were all set

sso update was already migrated to the shared cobraMutuallyExclusiveErrorMessage helper plus raw-argv pflag.Changed-semantics detection (CLI-1902); add was never migrated. This PR mirrors update's pattern in add.handler.ts:

• Byte-exact cobra template via cobraMutuallyExclusiveErrorMessage (group in Go's registration order; the violating subset sorted, per cobra's validateExclusiveFlagGroups).
• hasExplicitValueFlag raw-argv scan, so an explicit empty value (--metadata-file= --metadata-url x) still trips the mutex, while a bare --metadata-file --metadata-url (pflag consuming the second token as the first flag's value) correctly does not.
• The check runs before project-ref resolution, matching cobra's ValidateFlagGroups-before-RunE precedence.

Integration tests cover the exact-message case (byte-match), the explicit-empty --metadata-file= case, the consumed-value non-violation case, and single-flag happy paths. SIDE_EFFECTS.md now documents the cobra template and Changed semantics.

Review findings deliberately left open

A four-perspective review pass (architect / engineer / security / DX) approved the change; these pre-existing, cross-cutting observations were noted rather than fixed here:

• The mutex filter/fail orchestration is now duplicated between sso add and sso update — a family-root helper (e.g. sso.mutex.ts) is a reasonable follow-up.
• SSO_ADD_VALUE_FLAG_NAMES (like update's equivalent) is a hand-maintained mirror of the command's declared value flags with no compile-time sync guarantee.
• Telemetry flushes on a mutex violation, whereas Go's cobra fails flag-group validation before telemetry is installed — pre-existing divergence shared with sso update.
• The raw-argv scan doesn't understand global/inherited value flags or the -t shorthand — documented limitation shared with sso update; pflag fails -t's enum validation before flag groups anyway.
• The --domains= explicit-empty edge on add (parity audit §3.10) is a separate issue and is not addressed here.

Fixes CLI-1982

https://linear.app/supabase/issue/CLI-1982/sso-add-mutual-exclusivity-error-is-not-cobra-format

[Coly010]

@codex review

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: bb94ec7ee8

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Reconcile parsed flags before suppressing the mutex

For inputs such as sso add --type saml --project-ref --metadata-file file.xml --metadata-url URL, this scan treats --metadata-file as the value consumed by --project-ref, matching pflag, but the Effect parser deliberately does not consume flag-shaped values (shared/cli/run.unit.test.ts:300-309) and therefore passes both metadata options to this handler. The mutex is consequently suppressed while lines 131-147 select the file and silently ignore the URL; previously the two parsed options produced a mutex error, while Go instead treats only the URL as set. The raw scan must also reconcile the effective parsed values before allowing execution.

AGENTS.md reference: apps/cli/AGENTS.md:L248-L256

Useful? React with 👍 / 👎.