Keep commas in env values and accept bare KEY=VALUE args in env set

[evanphx]

Fixes MIR-1168.

miren env set -e KEY=a,b,c was setting three variables (KEY=a, b, and c) because the flag library splits every repeatable string flag on commas. Once split, the pieces cannot be told apart from three separate -e flags, so the fix lives in mflags: a split:"false" struct tag that keeps each flag occurrence whole (mirendev/mflags#16, merged).

This PR:

• Bumps mflags to the merge commit of Add split:"false" tag to keep string array values whole mflags#16.
• Applies split:"false" to the -e and -s flags of env set and deploy, and to --org on auth provider add github, whose documented name:team1,team2 form was being split the same way.
• Lets env set accept bare KEY=VALUE arguments with no flag, treated the same as -e. Docs and an example cover this.

Tests go through the real flag set for all three commands. The command docs were regenerated and show no drift beyond the env set changes.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Team

Run ID: 39647b33-8273-4690-bbbf-670bcc38c098

📥 Commits

Reviewing files that changed from the base of the PR and between 15dd8fd and 1b2fee8.

⛔ Files ignored due to path filters (1)

• go.sum is excluded by !**/*.sum

📒 Files selected for processing (7)

• cli/commands/auth_provider_github.go
• cli/commands/commands.go
• cli/commands/deploy.go
• cli/commands/env.go
• cli/commands/env_set_flags_test.go
• docs/docs/command/env-set.md
• go.mod

Included review availability: 4 reviews are currently available. Your included PR review attempts over the past 7 days set your current allowance at 6 reviews per hour.

---

📝 Walkthrough

Walkthrough

The CLI now preserves comma-containing environment, sensitive, deployment, and GitHub organization arguments as single values. env set accepts positional KEY=VALUE arguments and combines them with flagged values. Tests, command help, and documentation cover the updated parsing behavior.

Priority: ⬇️ Low

Merge Risk: ⚪ Minimal · up to 1b2fe

This change stops the CLI from incorrectly splitting comma-containing environment values and GitHub team lists, and adds support for bare KEY=VALUE arguments in env set. The behavior is covered by new tests and documentation, and no unresolved correctness or stability concerns were found in the reviewed parsing paths.

---

_{Comment @coderabbitai help to get the list of available commands.}

[miren-code-agent]

🍪 biscuit: ✅ ready to merge — auto-review, non-blocking

I read through this change carefully. It does two concrete things: adds split:"false" to every []string flag that was being silently comma-split (fixing the root bug), and adds a rest:"true" positional-args field to EnvSet so users can write miren env set KEY=VALUE KEY=VALUE without -e. Both changes are wired correctly and consistently through the three affected commands (env set, deploy, auth provider add github).

What I checked:

• The split:"false" fix is applied to all four []string flags that needed it (Env, Sensitive in both env.go and deploy.go, and Orgs in auth_provider_github.go). I didn't find any other []string flag that handles comma-sensitive values that was left un-fixed.
• The merge in EnvSet of bare args into env via slices.Concat(opts.Env, opts.Args) is correct. The envSetReference path, the "nothing specified" guard, and ParseEnvVarSpecs all consistently use the merged slice.
• A bare positional arg without = (e.g. miren env set MYVAR) flows into parseEnvVarSpec, which already treats any arg without = as a "prompt for value" case — that's existing behavior, not a regression from this PR.
• The three new tests in env_set_flags_test.go are well-targeted: they exercise comma preservation in flag values, interleaved bare args and flag args being routed to the right fields, and the GitHub org team-list round-trip through buildGitHubConfigJSON. The TestAuthProviderGitHubOrgTeamsSurviveParsing test is especially useful because it validates the semantic impact of the split fix, not just the parsed slice.
• The mflags dependency bump (go.mod/go.sum) is what actually delivers the split:"false" feature; the hashes look consistent and there are no other unexpected dependency changes.
• Documentation (commands.go, docs/docs/command/env-set.md) accurately describes both features.

The change is clean and self-contained. I'm comfortable approving it.

---

🍪 full review note · comment /biscuit review to run biscuit again.

[phinze]

Approved upstream so you can repin to the merged commit