feat(s42): --live-dry-run CLI flag + dry-run summary

tests/test_live_dry_run.py

@@ -0,0 +1,57 @@
+"""S4.2 CLI surface for ``python -m portfolio_optimiser.run <proj> --live-dry-run``.
+
+The success arm proves the CLI wiring + rc + summary (the zero-chat-call guarantee itself is proven
+at ``run_project`` level in ``test_live_dry_run_loadbearing.py`` — ``main()`` exposes no
+``client_factory`` seam). The refusal arm proves a misconfigured profile (the AZURE placeholder map)
+yields a STRUCTURED refusal + ``rc 1`` pointing at preflight, never a raw traceback.
+"""
+
+from __future__ import annotations
+
+from pathlib import Path
+
+from portfolio_optimiser import run
+
+BUNDLE_DIR = Path(__file__).resolve().parents[1] / "shared" / "examples" / "bygg-energi-mikro"
+
+
+def test_cli_live_dry_run_ok(capsys) -> None:
+    """Success arm: LOCAL profile (offline client construction) + ``--live-dry-run`` → rc 0 and a
+    summary naming the profile + a no-model-call note. No socket (stops before ``debate.run``)."""
+    rc = run.main(
+        [
+            "BYGG-KONTOR-NORD",
+            "--docs-dir",
+            str(BUNDLE_DIR),
+            "--bundle-dir",
+            str(BUNDLE_DIR),
+            "--live-dry-run",
+        ]
+    )
+    assert rc == 0
+    out = capsys.readouterr().out
+    assert "LIVE-DRY-RUN OK" in out
+    assert "local" in out
+    assert "ingen modellkall" in out.lower()
+
+
+def test_cli_live_dry_run_azure_placeholder_refuses(capsys) -> None:
+    """Refusal arm: AZURE profile with the default bundled placeholder map → ``resolve_model`` raises
+    inside the eager factory build; ``main()`` catches it and prints a structured refusal to stderr
+    + returns rc 1 (pointing at preflight), never a traceback. Offline (pure map read)."""
+    rc = run.main(
+        [
+            "BYGG-KONTOR-NORD",
+            "--docs-dir",
+            str(BUNDLE_DIR),
+            "--bundle-dir",
+            str(BUNDLE_DIR),
+            "--profile",
+            "azure",
+            "--live-dry-run",
+        ]
+    )
+    assert rc == 1
+    err = capsys.readouterr().err
+    assert "refused" in err.lower()
+    assert "preflight" in err.lower()