Harden portable Redmine CLI runtime and cache writes

bin/redmine-runtime-completion.bash

@@ -0,0 +1,26 @@
+#!/usr/bin/env bash
+# Source this file; no network calls and no config/secret loading.
+_redmine_completion_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+source "$_redmine_completion_root/redmine_contacts_completion.sh"
+_redmine_runtime_complete() {
+  local cur="${COMP_WORDS[COMP_CWORD]}" prev="${COMP_WORDS[COMP_CWORD-1]}"
+  local common="--help --show-config --doctor --doctor-nmi --env-file --base-cache --base-url --project --mode --api-key-file"
+  COMPREPLY=()
+  case "$prev" in
+    --env-file|--cache|--cache-dir|--base-cache|--api-key-file|--config|--body-file)
+      while IFS= read -r entry; do COMPREPLY+=("$entry"); done < <(compgen -f -- "$cur")
+      return ;;
+    --mode) COMPREPLY=( $(compgen -W 'production dev' -- "$cur") ); return ;;
+    --source) COMPREPLY=( $(compgen -W 'cache api auto' -- "$cur") ); return ;;
+  esac
+  if [[ "${COMP_WORDS[0]}" == *rcontacts-live ]]; then
+    _redmine_contacts_completion
+    COMPREPLY+=( $(compgen -W "$common" -- "$cur") )
+  else
+    local commands="sync search view walk materialize-queues note customer-email set-fields meta-refresh contacts-sync contacts-search contact-show contact-set ticket-contact attachments entities browse tui textual-tui triage ocr-rename categories control-tag draft spam-check close-if-spam tag-maybe-customer decompose"
+    local flags="--cache-dir --config --allow-prod-writes --where --open-only --max-tickets --issue-id --contact-id --json --jsonl --ids-only --fetch --apply --private --body --body-file --remote-updated-since --remote-updated-before --remote-status-id --dry-run --quiet --run-log"
+    COMPREPLY=( $(compgen -W "$commands $common $flags" -- "$cur") )
+  fi
+}
+complete -F _redmine_runtime_complete rtl rtd rtickets-live rcontacts-live ./bin/rtl ./bin/rtd ./bin/rtickets-live ./bin/rcontacts-live
+unset _redmine_completion_root