fix(cli): default include_keys to False in soul export (#273)

[sshekhar563]

What

Fixes #273

The soul export command was passing include_keys=True by default, which included the private Ed25519 signing key in every exported .soul file.

Changes

• Added --include-keys flag to soul export (default: False)
• Private keys are only included when user explicitly passes --include-keys
• Help text warns: "Only use when migrating between your own devices"

Usage

# Safe default — no private keys in exported file
soul export aria.soul

# Explicit opt-in for device migration
soul export aria.soul --include-keys

[prakashUXtech]

Good catch on this one. Exporting the private signing key by default was a real leak, and the fix is right. I went through all the include_keys=True call sites on dev to check nothing else was affected, and the flip is complete: soul export was the only share-intended path that leaked the key, and the in-place saves (remember, evolve, and the rest) correctly keep it. --include-keys still works for migration. Clean change.

Two things before merge, both packaging rather than substance:

1. A test. Since this is a security default, it's worth locking in. A CliRunner test asserting the default export zip contains keys/public.key but not keys/private.key, and that --include-keys puts the private key back. tests/test_cli/ is the spot.

2. Docs. docs/cli-reference.md under soul export doesn't list --include-keys, and the "Portable transfer between machines" line now needs the flag to carry signing power. Worth updating both here.

One suggestion, non-blocking: the migrate-then-delete workflow now silently drops signing power, and with the quiet verification-only mode it's easy to miss until signing stops working. A one-line console notice on default export ("private key not included; pass --include-keys to migrate signing power") would save someone a confusing afternoon.

Also a stray extra blank line snuck in around main.py:705. Drop it while you're in there.

Thanks for the threat write-up on the issue too. Made this easy to verify.