v2.0.0

Major release: one consistent CLI grammar, a unified output layer, explicit mock mode, real debugging, and large performance gains. Breaking — no deprecation aliases; see migration below.

Highlights

• New grammar everywhere: object names are positional (scm set object address web1 --folder Texas ...); show without a name lists (the --list flag is gone). Every containerized set/delete/show accepts --folder | --snippet | --device with exactly-one validation — previously ~20 types were folder-only.
• Unified output: every show supports --output table|json|yaml and --max-results; tables render via rich, JSON/YAML are pure and pipe-safe (data on stdout, messages on stderr). One ✓/✗/⚠ message dialect across all ~380 commands; secrets are masked in show output.
• No more silent mock mode: missing/invalid credentials exit 1 with remediation steps. Opt into mock explicitly with SCM_MOCK=1 (or --mock where offered).
• Debugging: global --debug enables DEBUG logging (including SDK OAuth traffic) and full tracebacks; logging is configured once at startup (quiet WARNING default); invalid SCM_LOG_LEVEL warns instead of crashing; identity upsert failures now surface the real API error.
• Performance: startup 0.42s → ~0.10s (lazy command loading); OAuth tokens cached per context in ~/.scm-cli/cache/ (disable with SCM_NO_TOKEN_CACHE=1); bulk load runs 5-way concurrent (SCM_BULK_WORKERS), with rule-ordered types kept sequential.
• Safety: delete network zone / ipsec-crypto-profile / nat-rule now confirm before deleting (--force to skip).

Migration (old → new)

Old	New
--name web1 on set/delete/show	positional: scm set object address web1 ...
scm show ... --list	scm show ... (list is the default)
--tag a,b (CSV)	--tags a --tags b (repeatable)
layer3-subinterface --tag <vlan>	--vlan-tag <vlan>
scm operations status --job-id X	scm operations status --id X
insights --mock	SCM_MOCK=1 env var
silent mock fallback on missing creds	exit 1 + guidance (explicit SCM_MOCK=1 for mock)

Also: every load supports --dry-run, every backup supports --file (including SASE), and all docs (README, docs site) are synced to the new grammar.

Full changes: #243 #244 #245 #246 #247 #248 (PRs #249–#254)