feat: ingest CLI entry point

Per sub-project-2 plan Task 10. argparse entry wiring named fetcher +
HeuristicProposer into ingest_search/ingest_candidate; --query/--resolve,
--limit, --catalog, --media-root (env HEF_MEDIA_ROOT), --dominant-color.
Unknown archive -> exit 2, deferred archive -> exit 3. Secrets env-only.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

tests/test_ingest_cli.py

@@ -0,0 +1,25 @@
+import pytest
+
+from tools.ingest_cli import main
+
+
+def test_help_parses():
+    with pytest.raises(SystemExit) as e:
+        main(["--help"])
+    assert e.value.code == 0
+
+
+def test_unknown_archive_errors_cleanly(capsys):
+    rc = main(["bogus", "--query", "x"])
+    assert rc == 2
+    assert "unknown archive" in capsys.readouterr().err
+
+
+def test_missing_query_and_resolve_errors():
+    assert main(["nasa"]) == 2
+
+
+def test_deferred_archive_reports_not_implemented(capsys):
+    rc = main(["musopen", "--query", "bach"])
+    assert rc == 3
+    assert "deferred" in capsys.readouterr().err