docker --cloud build rejects BuildKit-only flags (--secret, --ssh, --push, --output, ...) with "unknown flag"

Finding: In an external report on docker/cli (https://github.com/docker/cli/issues/7350), docker CLI 29.9.0-rc.1, the first release with --cloud per the reporter, rejects BuildKit-only flags when run as `docker --cloud build`. The reported flags are --secret, --ssh, --push, --output, --load, --cache-to, --provenance, --sbom, --attest, --annotation, --builder and --allow. The error is "unknown flag: --secret", followed by legacy `docker build` usage text. Per the report, flags that the legacy builder also has (--target, --no-cache, --platform, --build-arg, -q) work. Reporter-supplied steps: create a Dockerfile that uses a secret mount, create a file for the secret, then run `docker --cloud build --secret id=s,src=./s .` (https://github.com/docker/cli/issues/7350). Reporter's hypothesis on the cause: cloudHelpRequest in cmd/docker/cloud.go looks for the command with rootCmd.Find and parses the remaining args against the flag set of the built-in legacy `build` command. That flag set lacks the BuildKit-only flags, so the parse error aborts the command before the alias that rewrites build to buildx build (processAliases) runs. This analysis comes from the reporter only. No maintainer confirmation is visible in the supplied content, so it is not a confirmed cause. Reported workarounds, which are source-backed and not verified by KFA: `docker --context docker-cloud build --secret ...` and `docker --cloud buildx build --secret ...` are said to build fine. Without a BuildKit-only flag, `docker --cloud build` is said to go through buildx. Reporter's suggested fix direction: apply the builder alias before help detection, or treat aliased plugin commands like plugin commands in cloudHelpRequest. This is a proposal, not a confirmed fix. Status and limitations: the issue is CLOSED, but the supplied content shows no maintainer comment, linked fix PR, commit or release, and no closure reason. Whether it was fixed, duplicated or dismissed is UNKNOWN. This is a single external report that KFA did not reproduce. The text was copied from an internal tracker and carries an AI-generation footer. Affected versions beyond 29.9.0-rc.1 are unknown.