Preserve API key CLI output compatibility

Why: U3 owner activation grants require protected files, while the merged U7 API-key command retains its existing optional file output.

Evidence: SELF go test ./cmd/agent-system ./internal/app -count=1.

Impact: Keep owner-grant delivery strict without changing API-key CLI defaults.

Refs: IAM U3 r1; U7 PR #185

cmd/agent-system/account_io_test.go

@@ -99,20 +99,6 @@ func TestExistingOutputAndConflictingFormatsRefuseBeforeMutation(t *testing.T) {
 	}
 }
 
-func TestAPIKeyCreateWithoutProtectedDestinationRefusesBeforeMutation(t *testing.T) {
-	dir, st := cliStore(t)
-	if err := st.CreateAccount("ada", "Ada", "", false); err != nil {
-		t.Fatal(err)
-	}
-	if rc := runAPIKey([]string{"create", "--data", dir, "--owner", "ada", "--name", "fixture"}); rc != 2 {
-		t.Fatalf("API key creation without private destination returned %d", rc)
-	}
-	var count int
-	if err := st.DB().QueryRow(`SELECT COUNT(*) FROM api_keys WHERE owner='ada'`).Scan(&count); err != nil || count != 0 {
-		t.Fatalf("rejected request created %d API keys: %v", count, err)
-	}
-}
-
 func TestAPIKeyCreateUsesExclusivePrivateOutput(t *testing.T) {
 	if dir := os.Getenv("U7_APIKEY_CHILD_DIR"); dir != "" {
 		rc := runAPIKey([]string{"create", "--data", dir, "--owner", "ada", "--name", "fixture", "--out-file", os.Getenv("U7_APIKEY_CHILD_OUT")})

cmd/agent-system/main.go

@@ -217,10 +217,6 @@ func runAPIKey(args []string) int {
 	*dsn = resolvedDSN
 	switch sub {
 	case "create":
-		if *outFile == "" {
-			fmt.Fprintln(os.Stderr, "apikey create: --out-file is required for protected credential delivery")
-			return 2
-		}
 		delivery, err := reserveCredentialOutput(*outFile, "")
 		if err != nil {
 			fmt.Fprintln(os.Stderr, "apikey create:", err)
@@ -233,6 +229,10 @@ func runAPIKey(args []string) int {
 			return 1
 		}
 		// 明文仅此一次输出；库中只存 SHA-256 摘要。
+		if delivery.file == nil {
+			fmt.Println(key) // Existing API-key CLI compatibility; owner grants require a file.
+			return 0
+		}
 		if err := delivery.deliver("api-key", *owner, key, nil); err != nil {
 			fmt.Fprintln(os.Stderr, "apikey create:", err)
 			return 1