feat(cli): add --help and --version flags

[dmchaledev]

Summary

The published sbom-diff CLI has no way to print usage or its version. Because unknown flags throw, the two commands a user reflexively runs first both fail:

$ sbom-diff --help
Unknown option: --help
Usage: sbom-diff <old.json> <new.json> [--format text|json|markdown]
$ echo $?
1

$ sbom-diff --version
Unknown option: --version   # exits 1 — no version output

For an npm-distributed binary, a broken --help/--version is a poor first-run experience and a discoverability gap. This PR adds both, self-contained to cli.ts.

Changes

• -h / --help — prints usage, arguments, options, and examples, then exits 0.
• -v / --version — prints the version read from the shipped package.json, resolved relative to the module (new URL('../package.json', import.meta.url)) so it works both from dist/ and via npx. Falls back gracefully if the file can't be read.
• Both flags short-circuit argument parsing, so they succeed even alongside otherwise-invalid arguments (e.g. sbom-diff --help --format=yaml) and never throw.
• README documents the new flags.
• parseArgs test coverage for --help/-h, --version/-v, the short-circuit behavior, and that normal invocations set neither flag.

Behavior after this change

$ sbom-diff --version
1.0.1

$ sbom-diff --help
sbom-diff — diff two CycloneDX or SPDX SBOMs into a change report.

Usage: sbom-diff <old.json> <new.json> [--format text|json|markdown]
...
$ echo $?
0

Scope / compatibility

• Touches only src/cli.ts, src/__tests__/cli.test.ts, and README.md.
• Purely additive: ParsedArgs gains help/version booleans; existing fields and default behavior are unchanged.
• Orthogonal to the in-flight diff/parser PRs — no overlap with the component-matching or parsing logic.
• npm run lint, npm run typecheck, npm test (33 passing), and npm run build all green; verified the built CLI end-to-end.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Wsn1rRnwNaxcCqP1vRuzPZ

---

Generated by Claude Code