bug: workspace access hint suggests a --subject command that fails for hyphen-leading OIDC subjects #4889

User Story

I use OpenShell with OIDC sign-in and workspaces. When a workspace denied me, I copied the suggested openshell workspace member add command from the error and it failed, because my OIDC subject starts with -. I need the suggested command to work as printed, so a user can grant access without working out clap's argument parsing.

Problem Statement

When a principal lacks workspace access, the gateway's permission-denied message suggests a remediation command (crates/openshell-server/src/auth/workspace_authz.rs, built with shell_quote_for_hint):

openshell workspace member add --workspace '<ws>' --subject '<subject>' --role user

The subject is shell-quoted, but quoting doesn't stop clap from parsing it. OIDC subjects are opaque strings and can start with -. When one does, --subject '-oAbC…' fails with error: unexpected argument '-o' found, because --subject in crates/openshell-cli/src/main.rs (workspace member add and workspace member remove) is a plain #[arg(long)] that doesn't accept hyphen-leading values.

Impact / Why This Matters

• The copy-paste remediation fails for any user whose subject starts with -, and clap's error points at a flag that doesn't exist, not at the cause.
• The workaround, --subject=-oAbC…, isn't obvious and isn't mentioned anywhere.

Acceptance Criteria

• openshell workspace member add --subject '<value starting with ->' … and workspace member remove accept the subject (for example via allow_hyphen_values), or the hint emits --subject=<quoted>.
• The remediation hint, copied verbatim, succeeds for a subject that starts with -.
• A test covers a hyphen-leading subject in both the hint and the CLI parsing.

Reproduction Steps

1. Sign in to an OIDC-enabled gateway as a user whose sub claim starts with -.
2. Run any command against a workspace you aren't a member of, and copy the suggested openshell workspace member add … --subject '-…' --role user command.
3. As a workspace admin, run the copied command.
4. Observe error: unexpected argument '-o' found.

Environment

• OpenShell: CLI 0.1.5-dev.124+g92434dcb2; gateway 0.1.6-dev.26+g229382e51
• OS: macOS (arm64)
• Runtime, deployment, or integration: OIDC authentication with workspaces

Suggested UX (if applicable)

openshell workspace member add --workspace 'my-ws' --subject='-oAbC123…' --role user

Logs

error: unexpected argument '-o' found