Update public CLI diagnostics dry run

scripts/cli-first-contract-smoke.js

@@ -127,6 +127,9 @@ for (const [name, pattern] of [
   ["process control report coverage", /fn process_restart_and_cancel_reports_expose_control_boundaries\(\)/],
   ["task restart report coverage", /fn task_restart_reports_clean_boundary_requirements\(\)/],
   ["build no full repo upload coverage", /fn build_command_reuses_bundle_inspection_without_full_repo_upload\(\)/],
+  ["inspect missing environment coverage", /fn bundle_inspect_reports_missing_environment_references_before_schedule\(\)/],
+  ["inspect source provider override coverage", /fn bundle_inspect_reports_source_provider_overrides_before_schedule\(\)/],
+  ["build missing environment gate coverage", /fn build_blocks_before_schedule_on_missing_environment_reference\(\)/],
   ["safe coordinator-required plans", /fn node_enroll_and_process_commands_have_safe_plan_without_coordinator\(\)/],
 ]) {
   expect(cli, name, pattern);
@@ -257,6 +260,21 @@ expect(
   "CLI parses dangerous capability overrides",
   /"host-filesystem"[\s\S]*Capability::HostFilesystem[\s\S]*"network"[\s\S]*Capability::Network[\s\S]*"secrets"[\s\S]*Capability::Secrets/
 );
+expect(
+  cli,
+  "CLI exposes source provider diagnostics",
+  /source_provider_statuses[\s\S]*source_provider_selection[\s\S]*source_provider_unsupported/
+);
+expect(
+  cli,
+  "CLI exposes environment pre-schedule diagnostics",
+  /environment_diagnostics_for_inputs[\s\S]*diagnose_environment_references[\s\S]*missing_environment/
+);
+expect(
+  cli,
+  "CLI blocks build before scheduling unsafe inputs",
+  /blocked_before_schedule[\s\S]*scheduled_work[\s\S]*false/
+);
 
 for (const [name, pattern] of [
   ["agent --json flag", /struct AgentEnrollArgs[\s\S]*#\[arg\(long\)\]\s*json: bool/],