Add built-in jq filtering - #203

Before

Agent or script needs selected HEY response fields
└── Run a structured HEY command
    └── ❌ Pipe the full response through an externally installed jq binary

After

Agent or script needs selected HEY response fields
└── Run a structured HEY command with --jq
    └── ✅ Filter the response inside hey  ← CHANGED

--jq filters the full success envelope and implies JSON output. --quiet --jq filters data directly. Scalar strings print as text, compound values print formatted JSON, multiple results stream predictably, and error envelopes remain complete.

Raw-output paths (auth token, completion, skill display, the TUI, and --version) reject --jq rather than silently ignoring it.

• ✅ Unit coverage exercises scalar, object, array, multiple, empty, environment, invalid, runtime-error, error-envelope, and large-integer behavior.
• ✅ Command coverage exercises registration, conflicts, unsupported raw commands, and version behavior.
• ✅ Terminal-focused coverage exercises CSI/OSC/C1 stripping, compound values, collision-safe hostile keys, and byte preservation for pipes.
• ✅ Copilot feedback on explicit-empty filters and local-config trust was validated, fixed in ac9d4b1, replied to, and resolved with focused regressions.
• ✅ CLI demo recording shows the flag in help and a built-in filtered response.

GOWORK=off make test                                      PASS
GOWORK=off make lint                                      PASS (0 issues)
GOWORK=off go test -race ./internal/output ./internal/cmd PASS
Binary smoke checks for filtering and unsupported paths   PASS
Independent adversarial diff review and re-review         PASS (no P2/blockers)

Included:

• global --jq parsing, validation, and help
• gojq evaluation with environment lookup
• full-envelope and quiet data-only filtering
• terminal-safe result rendering without key loss
• explicit unsupported raw-output behavior
• README, embedded skill, dependency manifests, and CLI surface updates

Not included:

• changing ordinary --json, --quiet, or styled output
• filtering error envelopes
• extending --jq to raw token, script, document, version, or TUI output
• promising byte-for-byte compatibility with the external jq executable

gojq is linked into the existing Go binary. There are no migrations, feature flags, credentials, backfills, or deploy-order requirements. Rollback is a normal revert of this commit.

Start with output semantics and terminal-safe rendering. Confirm that filtering only successful structured responses, while retaining complete error envelopes and rejecting dedicated raw formats, is the right boundary.

1. internal/output/writer.go and internal/output/errors.go — filter execution, rendering, safety, and errors.
2. internal/cmd/root.go and internal/cmd/local_config_trust.go — global flag wiring, raw-command boundaries, and machine-output trust behavior.
3. internal/output/writer_test.go, internal/cmd/jq_test.go, and internal/cmd/local_config_trust_test.go — behavioral and security regressions.
4. README.md, skills/hey/SKILL.md, go.mod, .surface, and help coverage — guidance, dependency, and public surface.

Origin and supporting links: Basecamp card