My #3129 gate wrongly skipped provisioning for a bare `omniroute` invocation —
but `serve` is isDefault:true, so bare runs the server, which needs the key.
Only --version/--help/help/completion skip now. Realigns with #1622: its bootstrap
test invoked `--help` (now correctly skipped), so it's switched to `config list
--json` (a real, fast, offline command) to exercise the provisioning path.
Running any CLI command — even `omniroute --version` or `--help` — generated a
32-byte STORAGE_ENCRYPTION_KEY and created `~/.omniroute/.env` (or DATA_DIR/.env).
A read-only command should never mutate the data dir. Gate the provisioning
behind shouldProvisionStorageKey(): skip for --version/--help/help/completion and
bare invocations; still provision for real commands (serve, keys, …) so the
encryption key persists before storage is accessed (#1622).
