Why: U3 owner activation grants require protected files, while the merged U7 API-key command retains its existing optional file output. Evidence: SELF go test ./cmd/agent-system ./internal/app -count=1. Impact: Keep owner-grant delivery strict without changing API-key CLI defaults. Refs: IAM U3 r1; U7 PR #185