feat!: list local models by default, move catalog to mlxcel arch

[inureyes]

Summary

Flip the default for mlxcel list: it now lists local downloaded models (the former --local behavior), and the supported-architecture catalog moves to a new mlxcel arch verb. The --local flag is removed outright. This is a breaking change (impact:breaking).

This aligns the bare verb with every comparable tool (ollama list, docker images, pip list, brew list all show the local inventory with no flag) and with mlxcel's own store-centric run / download / rm verbs. The catalog lists model families (Llama, Qwen, Gemma) whereas list lists concrete runnable repo-ids, so the two belong under separate verbs.

What changed

• src/main.rs — List variant doc retargeted to the local store (keeps the ls alias); new Arch(ArchArgs) variant with a supported alias and doc "List supported model architectures"; ListArgs::local field removed and models_dir doc dropped its "only meaningful with --local" sentence; struct-level ListArgs doc rewritten; new empty ArchArgs struct so the verb can grow flags later; main() dispatch now always calls run_list_local for List and renders the catalog for Arch. print_supported_models / write_supported_models / FAMILY_ORDER are unchanged (now reached via arch).
• src/commands/models.rs — module / run_list_local / render_local_models docs drop the --local framing; both empty-store hint branches (Some/None) append "To see supported architectures, run mlxcel arch."; the rm not-found hint now says mlxcel list; the two empty-store tests assert the new mlxcel arch hint. The render_local_models table format is untouched (REPO ID / SIZE / PATH — the table redesign is Improve the mlxcel list output UI (columns, modified-time, --json/--quiet, TTY styling) #141, out of scope).
• src/downloader/store.rs — the now-stale StoredModel doc surface name updated from mlxcel list --local to mlxcel list.
• src/main_tests.rs — new clap parse tests: list → Commands::List (default models_dir == None), ls alias → Commands::List, list --models-dir /tmp/x → Some(PathBuf::from("/tmp/x")), a negative test that list --local is rejected as an unknown argument (pins the removal), arch → Commands::Arch, supported alias → Commands::Arch. Existing supported_models_* tests remain valid (now covering arch's renderer).
• README.md, docs/supported-models.md, docs/environment-variables.md — mlxcel list --local usages updated to mlxcel list; the "without --local prints the supported model architectures" paragraph rewritten to point at mlxcel arch; the model-support snippet that ran mlxcel list for the catalog now runs mlxcel arch; docs/supported-models.md "The mlxcel list output..." → "The mlxcel arch output..."; docs/environment-variables.md "list --local / rm" → "list / rm".
• CHANGELOG.md — BREAKING ### Changed entry under [Unreleased] describing the default flip, the new arch verb, and the --local removal (pre-1.0, no deprecation cycle).

Breaking change

mlxcel list no longer prints the supported-architecture catalog; it now lists local downloaded models (previously mlxcel list --local). The --local flag is removed and clap rejects it as an unknown argument. Migration: use mlxcel arch for the catalog, and drop --local from any mlxcel list --local invocation (the bare form now does the same thing). Acceptable pre-1.0 (v0.1.x) because --local had not seen real-world use.

Test plan

• New parse tests cover list / ls / arch / supported / list --models-dir, and a negative test pins list --local rejection.
• Existing supported_models_* tests remain valid (now exercising arch's renderer); render_* tests in models.rs remain valid, with the two empty-store tests extended to assert the mlxcel arch hint.
• cargo test / cargo clippy / cargo fmt --check (run by the orchestrator after merge-readiness; not run in this change set).

Closes #138

[inureyes]

Security & Performance Review — PR #142

Reviewed the full diff against origin/main (commits 9aecb16, faa461c), scope = changed files, severity threshold = LOW. Verified with the warm-target narrow commands.

Verdict: No security or performance findings. Approve from a security/perf standpoint.

Severity breakdown

• 🔴 CRITICAL: none
• 🟠 HIGH: none
• 🟡 MEDIUM: none
• 🟢 LOW: none

What was checked

• No new panic/unwrap/expect on user-reachable input. Commands::Arch(_) ignores its empty args; run_list_local is unchanged and returns Ok(()); render_local_models guards max() with unwrap_or(0) and discards only the infallible fmt::Write Result (documented). No new error path.
• No format-string / output-injection risk. The two new empty-store hint strings (To see supported architectures, run \mlxcel arch`.) are pure literals with no interpolated user data. The repo-id / path that do reach writeln!are positional{}` args (not the format string) and are unchanged by this PR.
• No performance regression. Dispatch stays O(1) (a match arm); the store-listing render is the same single O(n) pass over local snapshots — the change adds only static bytes to the empty-store branch. No new I/O, network, allocation in hot paths, or concurrency.
• --local removal is clean. No dangling args.local / .local references remain (grep-confirmed); the only surviving --local token is the negative parse test that pins the removal. Unrelated --local-dir (a different, untouched flag) is correctly left alone. The match cli.command remains exhaustive with the new Arch arm; rustc/clap enforce completeness. No unsafe block was touched (the PR diff contains zero unsafe lines).

Verification (warm target, narrow commands)

• cargo clippy --bin mlxcel --tests -- -D warnings — clean, no warnings.
• cargo test --bin mlxcel — 88 passed, 0 failed, including the 6 new parse tests (list / ls / arch / supported / list --models-dir, and the list --local rejection) and the two extended empty-store hint assertions.

No fixes required; no developer sub-agent delegation needed.