[JohnsonLyu]

Summary

Fixes #709.

• Enable darnit plan --profile by reusing the existing profile resolution logic from audit.
• Support profile filtering alongside --include, --exclude, and --tags, with consistent error handling for invalid or empty selections.
• Remove the obsolete darnit plan and darnit validate crash on openssf-baseline: controls mix level=None and int #568 restriction and add regression tests covering profile selection, filter combinations, and controls without levels.

Type of Change

• Bug fix (non-breaking change fixing an issue)
• New feature (non-breaking change adding functionality)
• Breaking change (fix or feature causing existing functionality to change)
• Documentation update
• Refactoring (no functional changes)

Framework Changes Checklist

If this PR modifies the darnit framework (packages/darnit/):

• Updated framework spec (docs/architecture/framework-design.md) if behavior changed
• Ran uv run python scripts/validate_sync.py --verbose and it passes

Control/TOML Changes Checklist

If this PR modifies controls or TOML configuration:

• Control metadata defined in TOML (not Python code)
• SARIF fields (description, severity, help_url) included where appropriate
• Ran validation to confirm TOML schema compliance

Testing

• Tests pass locally (uv run pytest tests/ -v)
• Added tests for new functionality (if applicable)
• Linting passes (uv run ruff check .)

Focused CLI tests: 62 passed.

Framework sync validation and git diff --check passed.

AI assistance

• No AI assistance was used
• AI assistance was used

Cursor (Claude Opus 5.5) assisted with implementation and regression tests. Changes were reviewed and validated locally.

Additional Notes

The broader non-integration test run on Windows reported 4,594 passed, 127 failed, 66 errors, and 18 skipped. Failures include platform-specific issues involving POSIX permissions, symlinks, shell commands, path separators, and text encoding. The full suite has not passed locally, and some failures remain uninvestigated.

No control definitions or TOML configuration files were modified.

[Marc-cn]

Mirrors audit --profile exactly (_resolve_profile_ids, intersection with --include, error when nothing is left), and removes the #568 refusal that #597 made obsolete. Checked on the VM against main: plan --profile level1_quick lists the 26 level-1 controls and filters 40; --profile access_control --include OSPS-BR-01.01 exits 1 with the no-overlap error; tests/darnit/test_cli.py + config 665 passed, ruff clean. One side note, not this PR: the access_control profile references three controls that don't exist (OSPS-AC-01.02, 01.03, 02.02).