chore: address #219 review comments

- Add comment explaining biome.json scripts/bundle.ts exclusion
- Add note about readline API key visibility limitation

packages/cli-workflow/src/commands/init/workspace.ts

@@ -45,6 +45,8 @@ function biomeJson(): string {
     {
       $schema: "https://biomejs.dev/schemas/2.4.14/schema.json",
       files: {
+        // Exclude generated bundle script — it uses Bun globals and console that
+        // conflict with the workspace's Biome rules (noConsole, etc.).
         includes: ["**", "!**/node_modules", "!**/dist", "!scripts/bundle.ts"],
       },
       formatter: {

packages/cli-workflow/src/commands/setup/dispatch.ts

@@ -150,6 +150,8 @@ async function collectInteractiveSetup(): Promise<Result<SetupCliArgs, string>>
     if (baseUrl === "") {
       return err("base URL must not be empty");
     }
+    // Note: readline does not support masked input; API key is visible during entry.
+    // Acceptable for a local dev CLI — not a production-facing prompt.
     const apiKey = await promptLine(rl, "API key: ");
     if (apiKey === "") {
       return err("API key must not be empty");