quire ci run is the right tool for local testing — it exercises the
full orchestrator path and will dispatch via container when that
executor lands. quire-ci local bypassed the executor entirely and
would have diverged further from the real execution environment.

Also collapses TransportArgs::Filesystem(Option<ApiSession>) to
Filesystem(ApiSession) now that None was only used by local.

diff --git a/quire-ci/src/main.rs b/quire-ci/src/main.rs
index 69e0d88..e7e847e 100644
--- a/quire-ci/src/main.rs
+++ b/quire-ci/src/main.rs
@@ -52,17 +52,6 @@ enum Commands {
     /// Compile and validate a ci.fnl pipeline.
     Validate,
 
-    /// Run the pipeline locally against the workspace.
-    ///
-    /// Uses placeholder push metadata (SHA = 40 zeros, ref = "HEAD")
-    /// and no secrets — `(secret :name)` calls error, and `(jobs
-    /// upstream)` reads return Nil for everything except `quire/push`.
-    /// Sh logs are written to a tempdir and dumped to stdout when the
-    /// run finishes.
-    ///
-    /// For orchestrator-dispatched runs see the `run` command.
-    Local,
-
     /// Execute a pipeline dispatched by the orchestrator.
     ///
     /// `--bootstrap <path>` points at a JSON file (see
@@ -120,7 +109,7 @@ impl TransportFlags {
             auth_token,
         };
         Ok(match self.transport {
-            Transport::Filesystem => TransportArgs::Filesystem(Some(session)),
+            Transport::Filesystem => TransportArgs::Filesystem(session),
             Transport::Api => TransportArgs::Api(session),
         })
     }
@@ -209,14 +198,12 @@ pub enum Transport {
 
 /// Resolved transport.
 ///
-/// - `Filesystem(None)`: `local` subcommand; no server session.
-/// - `Filesystem(Some(_))`: `run` subcommand with filesystem executor;
-///   session info held for upcoming API route use.
-/// - `Api(_)`: `run` subcommand with HTTP API executor.
+/// - `Filesystem(_)`: filesystem executor; session info held for upcoming API route use.
+/// - `Api(_)`: HTTP API executor.
 #[derive(Debug)]
 #[allow(dead_code)] // session fields read by upcoming API client
 enum TransportArgs {
-    Filesystem(Option<ApiSession>),
+    Filesystem(ApiSession),
     Api(ApiSession),
 }
 
@@ -225,22 +212,6 @@ fn main() -> miette::Result<()> {
     let cli = Cli::parse();
     match cli.command {
         Commands::Validate => validate(cli.workspace),
-        Commands::Local => {
-            let miette_layer = MietteLayer::new();
-            telemetry::init_tracing(miette_layer, FmtMode::Plain)?;
-            let dir = tempfile::tempdir().into_diagnostic()?;
-            let log_dir = dir.path().to_path_buf();
-            let _dump = DumpLogsOnDrop { dir };
-            run_pipeline(
-                cli.workspace.clone(),
-                Box::new(NullSink),
-                log_dir,
-                cli.workspace.join(".git"),
-                placeholder_meta(),
-                HashMap::new(),
-                TransportArgs::Filesystem(None),
-            )
-        }
         Commands::Run {
             events,
             out_dir,
@@ -372,16 +343,6 @@ fn validate(workspace: PathBuf) -> miette::Result<()> {
     Ok(())
 }
 
-/// Standalone runs synthesize a placeholder `quire/push`. Real meta
-/// arrives via `--bootstrap` from the orchestrator.
-fn placeholder_meta() -> RunMeta {
-    RunMeta {
-        sha: "0".repeat(40),
-        r#ref: "HEAD".to_string(),
-        pushed_at: jiff::Timestamp::now(),
-    }
-}
-
 /// Read and parse the bootstrap file the orchestrator wrote before
 /// spawning. Wraps revealed secret values back into `SecretString`.
 ///