feat(cli): introduce explicit run/exec subcommands to prevent typo-execution

Prevent the ambiguity where a mistyped subcommand was interpreted as the target
wrapped process.

- Introduce `run` and `exec` (alias) subcommands for launching wrapped processes.
- Promote internal test commands (`test-ns`, `test-args`, `test-lifecycle`) to explicit subcommands.
- Update CLI routing to return an error for unknown subcommands instead of falling back to the default execution path.
- Update `README.md` usage examples and all test suites to use the new subcommand structure.

1 files changed, 9 insertions, 7 deletions

diff --git a/README.md b/README.md
index ee4ea6a..c7ef7c7 100644
--- a/README.md
+++ b/README.md
@@ -17,11 +17,12 @@ Import your WireGuard `.conf` file as a profile:
 ```
 
 ### 3. Run an Application
-Run any command wrapped in the VPN:
+Run any command wrapped in the VPN using the `run` subcommand:
 ```bash
-./wg-wrap --profile home-vpn -- curl https://ifconfig.me
+./wg-wrap run --profile home-vpn -- curl https://ifconfig.me
 ```
 *Only the `curl` command is routed through the VPN; your browser, SSH sessions, and other apps remain on your local network.*
+*Only the `curl` command is routed through the VPN; your browser, SSH sessions, and other apps remain on your local network.*
 
 ---
 
@@ -39,6 +40,7 @@ Manage your VPN configurations easily from the CLI:
 
 | Command | Description |
 | :--- | :--- |
+| `run [options] -- <cmd>` | Run a command in the wrapped environment. |
 | `profile list` | List all available VPN profiles. |
 | `profile import <path> [name]` | Import a `.conf` file as a new profile. |
 | `profile configure <name>` | Edit a profile's configuration in your default editor. |
@@ -46,7 +48,7 @@ Manage your VPN configurations easily from the CLI:
 | `profile stop <name>` | Force-stop an active tunnel session. |
 
 ### Diagnostics
-Check your environment and verify isolation:
+Check your environment and verify isolation using these subcommands:
 - `show-config`: View resolved paths and current isolation status.
 - `test-ns`: Verify that you are correctly isolated in a network namespace.
 - `test-args`: (For developers) Verify 8-bit clean argument passing.
@@ -57,20 +59,20 @@ Check your environment and verify isolation:
 
 **Run Firefox on a specific VPN:**
 ```bash
-./wg-wrap --profile privacy-vpn -- firefox
+./wg-wrap run --profile privacy-vpn -- firefox
 ```
 
 **Run a series of tests against a private VPC:**
 ```bash
-./wg-wrap --profile dev-vpc -- pytest tests/integration
+./wg-wrap run --profile dev-vpc -- pytest tests/integration
 ```
 
 **Connect to a home server and a work server simultaneously:**
 ```bash
 # Terminal 1
-./wg-wrap --profile home-vpn -- ssh home-nas
+./wg-wrap run --profile home-vpn -- ssh home-nas
 # Terminal 2
-./wg-wrap --profile work-vpn -- ssh work-server
+./wg-wrap run --profile work-vpn -- ssh work-server
 ```
 
 ---