feat: global -y/--yes flag to skip additive confirmations

repo create's y/N push confirmation can now be skipped with -y. The flag
is global (top-level parser), so it goes before the subcommand:
gitctl -y repo create ... . The diff is still printed and an
auto-confirmed note shown. -y does NOT bypass SSH key auth (the phase-1
push still needs the password / smartcard touch), so creation is never
fully unattended.

Hard wall: -y is never honored by a future destructive delete; the flag
help, a client comment, and TODO item 1 all record this. Bash completion
offers -y at the top level and transparently skips a leading -y when
resolving the subcommand. Self-test pins the parse round-trip.

Client-only change; the server helper is unchanged, no redeploy needed.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

1 files changed, 14 insertions, 14 deletions

diff --git a/TODO.md b/TODO.md
index 6318eae..c457702 100644
--- a/TODO.md
+++ b/TODO.md
@@ -66,22 +66,22 @@ Still open from the original plan: extend bash completion to complete repo
 NAMES (for `desc` / `delete` / `add-remote`) now that a list verb exists. The
 `repo list` action itself is already in completion.
 
-## 3. `-y` / `--yes` flag on `repo create`
+## 3. `-y` / `--yes` flag -- DONE
 
-Let an agent drive `repo create` without the interactive y/N, so the only human
-step left is supplying the SSH-key password / smartcard PIN for the push.
+`-y` / `--yes` is implemented as a GLOBAL flag (on the top-level parser), so it
+goes before the subcommand: `gitctl -y repo create ...`. Today the only y/N it
+skips is the phase-1 push confirmation in `repo create`; the diff is still
+printed and an "auto-confirmed" note shown. It does NOT bypass SSH key auth
+(password / smartcard touch), so creation is never fully unattended. Section
+auto-create was already silent, so behavior stays consistent.
 
-- Add `--yes` (`-y`) to `repo create`; when set, skip the `_confirm` prompt and
-  proceed to commit + push.
-- IMPORTANT: `-y` does NOT remove the need for a human at the SSH key. The
-  phase-1 `git push` to gitolite-admin still requires the key's password or the
-  card touch/PIN, which an agent cannot supply. `-y` removes only the y/N
-  diff-confirmation; the push auth is still interactive. Document this clearly
-  so nobody expects fully unattended creation.
-- Still print the diff before pushing even with `-y` (visibility), just do not
-  block on it.
-- Consider whether `-y` should also auto-create a missing section (it already
-  does that without asking) - keep behavior consistent.
+Hard wall for delete (item 1): `-y` must NEVER be honored by a destructive
+delete. The flag help says so, this note records it, and the global -y comment
+in the client points at item 1. When delete is built, it reads its own
+confirmation and ignores `a.yes`.
+
+Bash completion offers `-y`/`--yes` at the top level and transparently skips a
+leading `-y` when resolving group/action.
 
 ## Cross-cutting