atgc repo collaborators lists a repo's owner and the accounts its knot lets push. The web UI could grant or revoke that push access; the CLI could not.
atgc repo collaborators add <handle|did> and remove <handle|did> now do the same from the CLI. Both resolve the account and print it before writing, refuse anyone but the repo's owner (exit 4, in the knot's words), treat a repeat as a no-op, and take --repo, --remote, --dry-run and --json. No new OAuth scope is needed: they use the createRecord and deleteRecord rpc scopes atgc already requests.
Closes #1356.
🤖 Generated with Claude Code