- bash: propagate api_call failures (exit 1 on 400/401/403/404/network),
write diagnostics to stderr, escape message for JSON safety, help without
API key
- python: argparse options after subcommand (parents), single error message
per failure, network errors without traceback, idempotent already_completed
- move scripts to examples/maintenance/ with README instructions
- backend: correct stale envelope-shape comment in maintenance schemas
