fix: accept vault --deployment after the subcommand

[alongubkin]

Fixes ALIEN-1124.

Problem

--deployment was declared on the vault parent command without global = true, so it was only accepted before the subcommand. The remote command's own help shows it after:

alien vault set --deployment my-deployment customer-secrets GITHUB_TOKEN ghp_xxx

and that, like alien dev vault list --deployment …, failed with unexpected argument '--deployment'.

Fix

• alien dev vault: --deployment is global (default default, unchanged).
• alien vault: --deployment is global too. clap refuses a required global argument, so it's now an Option that the task checks, failing with a validation error when it's missing, as before.

Tests

• New vault_deployment_flag_parses_after_the_subcommand: alien vault set --deployment my-deployment … and alien dev vault list --deployment my-deployment … parse and carry the deployment.
• cargo test -p alien-cli --lib passes.

🤖 Generated with Claude Code

[greptile-apps]

Confidence Score: 5/5

[Medium risk] Changes how the vault command parses its deployment flag.

The PR appears safe to merge; no new actionable issues or outstanding previous findings remain.

Summary

The PR makes --deployment available after local and remote vault subcommands, and moves remote missing-flag validation ahead of credential resolution.

• Parsing tests cover the new flag position and the missing-flag error.

_{Reviews (2) · Last reviewed commit: "fix: report a missing vault --deployment..."}

[alongubkin]

@greptileai