fix(cli): make policy-versions --show --json compact and deterministic (#718)

[harmehak0173]

Slice

• Repo: doberman-core
• Feature / Slice: cli: policy-versions --show <id> --json prints indented JSON #718 - cli: policy-versions --show --json prints indented JSON
• Plan reference: n/a (issue-driven bug fix)

What this PR does

Passes as_json into _policy_versions_show and outputs compact, sorted JSON when --json is supplied (json.dumps(payload, sort_keys=True, separators=(",", ":"))). Preserves the indented format (indent=2) for human-readable output when --json is omitted.

Tests added (run in CI)

• Updated tests/unit/test_cli_policy_versions.py:
  • test_show_resolves_a_prefix_and_prints_the_snapshot: asserts indentation is preserved in the default human-readable view.
  • test_show_json_is_compact_and_deterministic: asserts --show <id> --json emits a single-line compact JSON document with sorted keys and identical byte-for-byte rerun output.
• Added tests/unit/test_cli_json_contract.py:
  • Parametrized contract test verifying CLI.md:109-119 guarantees (parseable, compact single-line, sorted keys, rerun determinism) across all --json modes (status, scan, doctor, policy-history, policy-versions, policy-versions --show, and tune).

Changelog

• changelog.d/725.fixed.md fragment added

Public-release safety (doberman-core only)

• Contains nothing from the "not allowed" list: no enterprise/hosted code, no proprietary detection, no customer data, no secrets, no commercial-license code
• Core still builds/tests/runs with NO enterprise package installed

Security checklist

• Fails closed on error / uncertainty
• No secret, full file, or unredacted prompt logged or committed
• Any guardrail/learning change is raise-only (no silent loosening)
• Every BLOCK/AUTH carries reason codes + a human explanation
• doberman-core does not import doberman_enterprise

Edge cases covered / Deviations from plan / Risks introduced

None.

Fixes #718

[fu351]

Merged this and #733, thanks @harmehak0173. #733 fixes the tone error, and #734 brings --show --json in line with the CLI.md contract. The best part of #734 is the contract test in test_cli_json_contract.py. It covers every --json command, so if one of them drifts, CI fails.

You've done two level-2 CLI fixes, so the next rung up is #720: add --dry-run to decision-log-prune. It's level-3. It stays in cli/main.py and also takes you into storage/log.py. The issue spells out the approach: run the same deletes, count the rows, then roll back instead of committing. Comment on it to claim it.

Roadmap and design talk happens on Discord: https://discord.gg/Sfy5XGNqty

---

Generated by Claude Code