Split the six cognitive-complexity hotspots into options → operation → renderer

Why

Measured cognitive complexity: runNetwork 157, Config.Validate 112, runImage 110, runSetupCommand 100, Manager.Up 97, runPrivateCommand 92. The CLI handlers mix argument checks, host probing, and three output formats in one body, which is why every review finds another bypass of the error layer.

Proposed shape

• Per CLI handler: typed options (mostly present) → one domain call returning a typed result → one renderer per format.
• runNetwork: separate install / uninstall / status handlers, per OS.
• Manager.Up: extract the existing-state branch (diff, phase classification, the startExisting decision) into a named function shared with Reload.
• Config.Validate remains one validator; factor the repeated node loops but do not split it to chase a number.

Acceptance

• No function above roughly 40; behaviour and exit codes unchanged with the existing tests as the oracle; one extraction per commit.
• Best done after #6 so each renderer has a typed result to consume.

Start after issue #6, then read the existing handlers and the Manager.Up/Reload and Config.Validate entry points. Run the existing tests first and use them as the behavior and exit-code oracle while making one extraction per commit. Done means the proposed options → domain result → renderer structure is in place, functions stay roughly under 40 lines, and behavior is unchanged.