test(e2e): guard BundleExport comma + document DeleteAreaAsync (review fixes)

tests/ZB.MOM.WW.ScadaBridge.CentralUI.PlaywrightTests/Cluster/CliRunner.Helpers.cs

@@ -194,6 +194,15 @@ public static partial class CliRunner
     /// swallows any failure.
     /// </summary>
     /// <param name="id">Area id.</param>
+    /// <remarks>
+    /// This method intentionally does NOT delegate to <see cref="BestEffortAsync"/>
+    /// even though the behaviour is identical. <see cref="BestEffortAsync"/> models
+    /// two-word commands (<c>&lt;group&gt; &lt;verb&gt;</c>), whereas
+    /// <c>site area delete</c> is a three-word command; extracting it would require
+    /// changing <see cref="BestEffortAsync"/>'s signature or adding an overload.
+    /// The inline try/catch is kept here deliberately — if you need to fix teardown
+    /// logic, update both this method and any other three-word deletes together.
+    /// </remarks>
     public static async Task DeleteAreaAsync(int id)
     {
         try
@@ -267,6 +276,16 @@ public static partial class CliRunner
         string outputPath, int templateId, string passphrase, string sourceEnvironment)
     {
         var templateName = await ResolveTemplateNameAsync(templateId);
+
+        // The CLI's --templates flag is comma-separated, so a name that itself
+        // contains a comma would silently split into multiple selectors and scope
+        // the export to the wrong set of templates.
+        if (templateName.Contains(','))
+        {
+            throw new InvalidOperationException(
+                $"Template name '{templateName}' contains a comma and cannot be used with '--templates'.");
+        }
+
         await RunAsync(
             "bundle", "export",
             "--output", outputPath,