Second half of #243. Stacked on #244 — base is fix/auth-help-stale-login-examples; review/merge #244 first, then this retargets to main.

Problem

datumctl auth login and datumctl auth logout don't error. Cobra treats the unknown subcommand as a positional arg, the auth group has no RunE, so it reprints the group help and exits 0. A user following old docs or muscle memory gets no signal the command is invalid — and (before #244) the help they saw repeated the wrong spelling.

Login/logout were deliberately promoted to top-level commands in the context-discovery redesign (#149, PR #149); they are not coming back under auth. So the fix is to fail loudly and redirect, not to re-add aliases.

Change

auth now validates its args (cobra.ArbitraryArgs + RunE):

• Moved commands (login, logout) → targeted error with a hint at the replacement:

  $ datumctl auth login
  error: 'datumctl auth login' is now 'datumctl login'
  Log in and log out are top-level commands — run 'datumctl login'.
  $ echo $?
  1
  

• Any other unknown subcommand → generic error pointing at --help:

  $ datumctl auth bogus
  error: unknown command "bogus" for 'datumctl auth'
  Run 'datumctl auth --help' for available commands.
  

• Bare datumctl auth → still prints help, exits 0.
• Valid subcommands (list, switch, get-token, update-kubeconfig) route unchanged.

Both errors carry a machine-readable Code (AUTH_COMMAND_MOVED, UNKNOWN_SUBCOMMAND) so structured (--error-format json) consumers and agents can branch on them:

$ datumctl auth logout --error-format json
{"error":{"code":"AUTH_COMMAND_MOVED","message":"'datumctl auth logout' is now 'datumctl logout'","hint":"...","retryable":false}}

Tests

internal/cmd/auth/auth_test.go covers bare-auth-help, both moved-command hints, the generic unknown case, and that valid subcommands still resolve. go build ./... and go test ./internal/cmd/auth/... pass.