[viwe-monai]

Fixes #4889

Problem

OIDC subjects are opaque strings and can start with -, but workspace member add/remove --subject is a plain #[arg(long)], so the remediation hint the gateway prints on a permission denial cannot be copied verbatim for such principals:

openshell workspace member add --workspace '<ws>' --subject '-oAbC…' --role user
error: unexpected argument '-o' found

Fix

• Mark both --subject arguments (workspace member add and workspace member remove) allow_hyphen_values = true, so the quoted hint form parses as one value. The server-side hint already shell-quotes the subject (covered by the existing non_member_remediation_shell_quotes_untrusted_subject test), so with the CLI fixed the printed command now works as printed.
• Acceptance criteria item 1 is met via the allow_hyphen_values route; the hint keeps its current shape (no server-side change needed).

Tests

• openshell-cli: workspace_member_parses_hyphen_leading_subject — parses --subject -oAbC123 on both add and remove and keeps the value intact. (Previously: error: unexpected argument '-o' found.)
• openshell-server: non_member_remediation_handles_hyphen_leading_subject — the deny hint for a hyphen-leading subject keeps --subject '-oAbC123' quoted and intact for copy-paste.

cargo test -p openshell-cli workspace_member_parses_hyphen_leading_subject  → 1 passed
cargo test -p openshell-server workspace_authz                            → 17 passed, 0 failed

cargo fmt clean for the touched crates.

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[github-actions]

Thank you for your interest in contributing to OpenShell, @viwe-monai.

This project uses a vouch system for first-time contributors. Before submitting a pull request, you need to be vouched by a maintainer.

To get vouched:

1. Open a Vouch Request discussion.
2. Describe what you want to change and why.
3. Write in your own words — do not have an AI generate the request.
4. A maintainer will comment /vouch if approved.
5. Once vouched, open a new PR (preferred) or reopen this one after a few minutes.

See CONTRIBUTING.md for details.

[github-actions]

Thank you for your submission! We ask that you sign our Developer Certificate of Origin before we can accept your contribution. You can sign the DCO by adding a comment below using this text:

---

I have read the DCO document and I hereby sign the DCO.

---

_{You can retrigger this bot by commenting recheck in this Pull Request. Posted by the DCO Assistant Lite bot.}