feat(cli): add unified confirmation for high-risk operations

[XXPermanentXX]

Summary

• add typed command risk metadata and a runtime-owned --yes confirmation gate
• return exit code 7 with error.type: "requires_confirmation" before authentication and business execution, while keeping confirmation failures observable in telemetry
• migrate 10 existing high-risk commands: Knowledge delete/deploy operations, Managed Agent apply/destroy, and permission revoke
• expose localized risk information in leaf help and generated Skill references, and instruct agents never to add --yes automatically
• validate dynamic Command Pack risk metadata at runtime

Behavior

High-risk commands declare:

risk: {
  level: "high",
  message: {
    "en-US": "...",
    "zh-CN": "...",
  },
}

Without --yes, the runtime stops with a structured confirmation request. After explicit confirmation, the same operation can be re-run with --yes. --dry-run remains a preview path and does not require confirmation.

Additional high-risk command coverage will be added by the corresponding domain owners in follow-up changes.

Verification

• vp test packages/runtime/tests packages/cli/tests/skill-risk-confirmation.test.ts: 90 passed
• relevant Knowledge / Managed Agent / permission confirmation suites passed; 3 unrelated live permission list cases returned HTTP 404 in the current credential environment
• vp check: 0 errors, 3 existing warnings
• vp run -r build: passed
• BAILIAN_E2E=0 pnpm ready: check passed, but the full test phase remains blocked by 9 existing host-isolation failures where machine-level /etc/codex is detected inside fake-HOME Skill Agent tests