v1.29.0

Follow-up to the Platform API GA: two breaking renames, spec ingests up to
jamfplatform-go-sdk v1.0.0, and a run of fixes.

CHANGELOG.md carries the migration detail. Every renamed
command, every moved invocation, and why.

Breaking — pro command names come from the spec (#377)

Resource names now come from the API's own OpenAPI tags and URL paths instead of
the filenames upstream's specs were split into. 163 resources became 135: 38
renamed, 24 merged, 13 split. The names match what the Jamf Pro API reference
calls these resources.

• Every former name still works until 2027-03-09. 100 resolve to their
  replacement and print a warning naming it. 3 refuse, their endpoints no longer
  being ingested. Neither --quiet nor --no-hints silences the warning.
• 48 invocations an alias cannot cover, where a resource split or an
  operation's name moved with it. All 48 answer at runtime naming the new
  invocation, exit 2.
• An independently-writable sub-path is a nested command now:
  pro sso-settings cert delete rather than pro sso-settings delete deleting
  the certificate.
• 19 write operations that were being deleted at generate time now ship,
  among them pro enrollment-customization create, update and delete, which
  addressed an LDAP panel.
• No command name carries an API version.

Breaking — --file is --from-file on Platform and Security Cloud writes (#372)

41 flag registrations renamed. All 361 commands that read a body from a path now
agree on the name. There is no compatibility alias: --file exits 2 with
hint: did you mean --from-file?. The 11 upload commands keep --file, their
payload being one a pipe cannot carry.

Added

• apply on six gateway resources (#372): security dns-zones,
  ztna-apps, ztna-gateways, ztna-grouped-gateways, device-groups and
  platform ai-policies. It keys on the name in the body, and updates with
  PATCH, so a field you omit keeps its current value.
• Platform and Security Cloud bodies can be piped (#372). --from-file is
  optional, so --scaffold | edit | apply no longer routes through a temp file.
• pro setup --credentials existing (#375) takes an API client you already
  hold, and both branches prove the credentials against the server before writing
  the profile.
• pro backup (#346) covers advanced searches, lists its own resource names
  (pro backup list-resources), and refuses a typo in --resources.
• pro report software-installs gains --bundle-id and --path (#348).
• The showcase site is rebuilt on Nebula v5 tokens (#351).

Fixed

• Every command prints through the shared output formatter (#359). 24 built
  their own, parsing --out-file, --select, --compact, --quiet and
  --no-hints and then discarding them: --out-file exited 0 and left a 0-byte
  file while the rows went to stdout.
• A stray positional is refused on every leaf that documents none (#360).
  pro backup /tmp/out used to run a whole backup and ignore the directory.
• --scaffold reaches the modern Pro generator's own commands (#363, #373).
  26 leaves validated their positionals first and never printed the template.
• Row narrowing follows every column format, not the three spelled out
  (#353, #376), and pro report blueprint-status keeps its count columns when
  the first row is NOT_DEPLOYED (#374).
• A destructive x-action sends its own method. pro mobile-device-groups erase --from-file sent DELETE to a POST-only path and reported Deleted;
  the prompt offered to "delete N computer-inventory" for a fleet wipe.
• The deprecation warning and the moved-verb refusal survive a global flag
  placed between the product and the resource token, as in
  jamf-cli pro -p ci-svc icons get 1.
• A name lookup reports an ambiguity, or a match it cannot address, instead
  of picking one copy silently.
• gatewaySuccessor reaches commands -o json (#345).
• A cobra usage error exits 2, not 1 (#347).
• CI's Test step is 57% faster (#361).

Specs

Gateway coverage and the Platform API surface come from jamfplatform-go-sdk
v1.0.0. The Go module and the specs name one tag again: the ingest target only
copied api/, so go.mod had drifted to v0.20.1 against specs from v0.22.2.

• ai_governance_policies_api.json at build v2121 adds an ETag/If-Match
  concurrency protocol. Only the read half reaches a command. The platform
  emitter renders query parameters, so platform ai-policies patch and apply
  still send an unconditional write.
• pro_api.json goes to 701 operations, GET /v1/mdm/commands having been
  restored. No command sends it, v2 being published already, so the binary still
  refuses 59.