feat(find): talonctl find — resolve any identifier to a template

[willwebster5]

Summary

Adds talonctl find QUERY — an offline, read-only subcommand that resolves an arbitrary identifier to one or more talonctl-managed resources. Closes #10.

• Resolution strategies (ordered, first non-empty wins): rule_id UUID → resource_id → composite ID (ngsiem: / fcs: / thirdparty: / cwpp:) → display-name substring → glob on resource_id.
• All seven resource types covered (detection, saved_search, workflow, lookup_file, rtr_script, rtr_put_file, dashboard).
• Three output formats: table (default, rich Table / Panel for non-IaC composite alerts), json (stable shape), path (bare template paths for xargs).
• --include-undeployed scans on-disk templates alongside state (state wins on dedup).
• Offline-only: never loads credentials, never calls the Falcon API.
• Exit codes: 0 on match or recognized non-IaC prefix, 1 on zero-match, 2 on malformed args or corrupt state file.

Architecture

• Pure logic in src/talonctl/core/resource_finder.py (dataclasses, constants, ResourceFinder with ordered method chain).
• Thin Click wrapper in src/talonctl/commands/find.py.
• cli.py gets a _TalonGroup subclass that suppresses the shared banner when find is invoked with --format json / --format path, so stdout pipes cleanly.

Spec + plan were brainstormed first (see docs/superpowers/specs/2026-04-21-talonctl-find-design.md and docs/superpowers/plans/2026-04-21-talonctl-find.md — both gitignored, local only).

Tests

• 537 unit tests passing (64 new: 40 in test_resource_finder.py, 24 in test_find_command.py).
• All 10 acceptance criteria from issue feat: add talonctl find — resolve any identifier (UUID, resource_id, name, composite alert ID, glob) to a template path #10 are locked in as TestAcceptanceCriteria::test_ac{1..10}_*.
• ruff format / ruff check clean.

Test plan

• CI unit-test job passes on the PR.
• Local smoke: against a real deployed_state.json, run `talonctl find <rule_id>` and confirm the matching template path appears.
• Pipe smoke: `talonctl find "aws_*" --format path | head -3` prints three bare paths with no banner preamble.
• JSON smoke: `talonctl find <rule_id> --format json | jq '.strategy_used'` returns `"rule_id"`.
• Non-IaC: `talonctl find fcs:abc --format json | jq '.non_iac_info.prefix'` returns `"fcs"` with exit 0.
• No-creds: run `talonctl find` in a directory without `~/.config/falcon/credentials.json` and confirm no auth error.

Follow-up items (not blocking)

1. Click 9 migration: _TalonGroup.invoke() in src/talonctl/cli.py:26-27 reads ctx.protected_args, which emits a DeprecationWarning under Click 8 and is removed in Click 9. Tests pass today (12 warnings in the suite), but we'll need to port the banner-suppression mechanism before bumping to Click 9.
2. JSON output helper: The spec describes console.print_json(...); the implementation uses click.echo(json.dumps(..., indent=2)) instead so stdout is guaranteed Rich-free and pipe-clean. Intentional departure from the spec wording.

🤖 Generated with Claude Code