CLI Control & Status — the headless CLI becomes the day-to-day control plane: wintui config edits any global setting, wintui rules manages per-package rules, and wintui cleanup scan reports what the Cleanup tab would reclaim, all without launching the TUI and without adding destructive automation.

• wintui config list/get/set/unset over the same 16 keys the Settings tab edits: human-readable values, strict validation (a typo is an error, never silently normalized), unset restores the real default, --json returns self-describing objects.
• wintui rules list/show/set/clear: show prints the explicit rule next to the effective value so inheritance is visible; set changes only the fields you pass in one write; holds are an explicit none/all/version state and a version hold is never silently turned into a permanent one; package IDs are case-insensitive.
• wintui cleanup scan: read-only per-target sizes with honest statuses (needs_admin instead of a wrong unelevated walk, partial with a lower bound, recent with what the age floor kept); deletion stays in the TUI.
• Behavior change: the Core Temp cleanup age floor is now the cleanup_min_age setting (off/1d/3d/7d) and defaults to 1 day instead of the previous hard-coded 7 days; every surface reports what the floor kept, and a non-elevated TUI shows "needs admin" instead of 0 B for admin-only targets.
• settings.json is safe for two writers: unique temp file + rename, delta writes from the CLI and TUI write points, never overwriting a file that cannot be parsed; a running TUI re-reads external changes on refresh and doctor warns while a change is pending.
• Per-package rule keys are matched case-insensitively with one canonical key per package; conflicting hand-edited duplicates are reported by doctor.
• Dependencies: go-runewidth 0.0.28 fixes a start-up/memory regression shipped in v2.11.x; bubbletea/bubbles/lipgloss routine refresh. Go toolchain unchanged (1.26.6); the Win32 syscall symbol set is identical to v2.11.2.