docs: clarify automation profile showcase workflow

docs/showcase/cli-tools/config-and-automation-profiles.md

@@ -5,7 +5,7 @@
 CleverAgents ships with a rich configuration system and a set of **automation
 profiles** that control how much autonomy the agent has when executing plans.
 This example walks through the complete workflow: inspecting configuration
-values, understanding the five-level resolution chain, switching automation
+values, understanding the six-level resolution chain, switching automation
 profiles, and creating a custom profile with guard constraints.
 
 ## Prerequisites
@@ -55,6 +55,10 @@ value, the **source** that supplied the value (one of `cli_flag`, `env_var`,
 from the built-in default. Secret values (API keys, tokens, passwords) are
 automatically masked as `****`.
 
+**Tip:** Add `--filter-values "."` to highlight only settings whose values
+deviate from defaults — we'll use this flag later in the "Try It Yourself"
+section.
+
 ---
 
 ### Step 2: Filter settings by key pattern
@@ -127,7 +131,7 @@ source.
 
 ---
 
-### Step 4: Inspect the full five-level resolution chain
+### Step 4: Inspect the full six-level resolution chain
 
 ```bash
 $ agents config get core.automation-profile --verbose --format json
@@ -160,7 +164,7 @@ $ agents config get core.automation-profile --verbose --format json
 
 **What's Happening:**
 
-The `--verbose` flag exposes the **five-level precedence chain** (highest →
+The `--verbose` flag exposes the **six-level precedence chain** (highest →
 lowest priority):
 
 | Priority | Source      | Description                                      |
@@ -454,6 +458,8 @@ guards:
 - `name` must be a bare name (`my-profile`) or namespaced (`namespace/name`)
 - `schema_version` must be `"1.0"` (quoted string)
 - All threshold fields are floats in `[0.0, 1.0]`
+- Values outside `[0.0, 1.0]` are rejected immediately — the CLI returns a
+  validation error at registration time
 - `guards` is optional — omit it for a profile without hard limits
 - `tool_denylist` blocks specific tools from being called
 
@@ -569,7 +575,32 @@ All subsequent plan executions will now use the `acme/cautious` profile.
 
 ---
 
-### Step 14: Remove the custom profile
+### Step 14: Reset to a safe default before removal
+
+```bash
+$ agents config set core.automation-profile supervised --scope global --format json
+```
+
+**Expected Output:**
+```json
+{
+  "data": {
+    "key": "core.automation-profile",
+    "value": "supervised",
+    "previous_value": "acme/cautious",
+    "source": "config_file",
+    "scope": "global"
+  }
+}
+```
+
+Resetting the config ensures there is no dangling reference to a profile that is
+about to be removed. Future plan executions immediately fall back to the
+built-in `supervised` profile.
+
+---
+
+### Step 15: Remove the custom profile
 
 ```bash
 $ agents automation-profile remove acme/cautious --yes --format json
@@ -595,10 +626,26 @@ $ agents automation-profile remove acme/cautious --yes --format json
 
 **What's Happening:**
 
-`--yes` skips the interactive confirmation prompt — useful in scripts. Built-in
-profiles cannot be removed; attempting to do so returns an error. The response
-includes the full profile data with `removed: true` so you can confirm what was
-deleted.
+`--yes` skips the interactive confirmation prompt — useful in scripts. Because
+the config was reset in Step 14, no automation profile setting points to the now
+deleted profile.
+
+---
+
+### Step 16 (Optional): Understand the error when removing a built-in profile
+
+```bash
+$ agents automation-profile remove supervised --yes --format json
+```
+
+**Expected Output (excerpt):**
+```
+Error: Built-in profiles cannot be removed.
+```
+
+Built-in profiles are immutable safeguards. The CLI responds with an error and a
+non-zero exit code, keeping the profile intact. This is the behavior referenced
+in Step 15.
 
 ---
 
@@ -660,9 +707,17 @@ $ agents automation-profile list --format json
 # 14. Activate the custom profile
 $ agents config set core.automation-profile acme/cautious --scope global --format json
 
-# 15. Remove the custom profile
+# 15. Reset to supervised before removal
+$ agents config set core.automation-profile supervised --scope global --format json
+# → previous_value: "acme/cautious"
+
+# 16. Remove the custom profile
 $ agents automation-profile remove acme/cautious --yes --format json
 # → removed: true
+
+# 17. (Optional) Attempt to remove a built-in profile
+$ agents automation-profile remove supervised --yes --format json
+# → exits with error: Built-in profiles cannot be removed.
 ```
 </details>
 
@@ -670,7 +725,7 @@ $ agents automation-profile remove acme/cautious --yes --format json
 
 ## Key Takeaways
 
-- **Config uses a five-level precedence chain**: `cli_flag` > `env_var` >
+- **Config uses a six-level precedence chain**: `cli_flag` > `env_var` >
   `local` > `project` > `global` > `default`. Use `--verbose` to see which
   level wins for any key.
 - **Three file scopes**: `--scope global` writes to `~/.cleveragents/config.toml`,