Exit-code class mismatches: `clickpipe --column bad` → 1, `auth login --api-key` alone → 4, `key create --hash-key-id` incomplete → 1, `skills` without a TTY → 1 (all usage errors, should be 2)

## Validated scope and current-PR plan — 2026-09-11

This section records the QA review and the current decision to finalize existing PRs without opening new PRs. It supersedes the proposed routing/fix suggestions in the original report below; the original observations are retained. Central plan: #757.

### Disposition

Deferred from this existing-PR finalization pass. Keep the issue open; no new PR is requested now. This is not a resolution, a severity downgrade, or a waiver of release acceptance.

### Validation and corrections

Reproduced column exit 1, incomplete hash exit 1, partial login credentials exit 4, and non-TTY skills exit 1. These are value grammar, cross-flag relationships and runtime interaction requirements, not fixed enum sets. Keep #775 focused; use clap requirements/parsers where possible and a deliberate post-parse usage path for TTY-dependent checks. Do not turn actual missing/invalid authentication into usage exit 2.

---

## Original QA report

Found in the 2026-09-11 QA sweep of the combined PR stack at [`d2c37f81`](https://github.com/ClickHouse/clickhousectl/commit/d2c37f814fff53fe68d636e34103e2d0550bf84d), top PR #823, installed release build (package version still 0.4.2). Reproduced behaviour only; no implementation included.

Severity: low; the "0 ok, 1 error, 2 usage, 3 cancelled, 4 auth" contract is otherwise followed precisely.

```sh
clickhousectl cloud clickpipe create object-storage "$SVC" … --column bad_no_colon
# Error: Invalid column format 'bad_no_colon': expected name:type exit 1, no Usage line
clickhousectl cloud auth login --api-key foo
# Error: --api-secret is required when --api-key is provided exit 4
clickhousectl cloud key create --name x --hash-key-id abc
# Error: pre-hashed API key input requires … together exit 1
clickhousectl skills # no TTY
# Error: Interactive selection requires a TTY. Use --all or --agent … exit 1
```

Every other malformed flag value in the same surfaces (`--format`, `--auth`, `--table-mapping`, `--field-mapping`, numeric ranges, clap `conflicts_with`) is a clap error with exit 2. `--column` is parsed in the handler rather than a `value_parser`; the others are hand-rolled companion-flag checks. Same class of fix as #684/#623.

Reproduce the four commands shown in the QA report and compare their handling with the other malformed values that already produce exit 2. Read the relevant handler parsing, clap value_parser usage, companion-flag checks, and TTY-dependent path; done means value-grammar, relationship, and required-interaction usage errors consistently return 2 without misclassifying authentication errors.

Written by the indexing model from the issue text.