feat(cli): add agent-first affordance — envelope, exit-10, --dry-run

Borrows the lark-cli agent-affordance model
(https://github.com/larksuite/cli/blob/main/AGENTS.md +
skills/lark-shared/SKILL.md) so weknora is designed to be agent-friendly:
error messages, output format, and flag design follow conventions agents
can rely on.

cli/AGENTS.md (operational reference for LLM agents invoking weknora):
  Public document covering envelope schema, exit-code protocol
  (0/1/2/10/130), stdout/stderr separation, and behavioral rules.
  Sensitive commands (\`context use\`, \`kb delete\`, \`doc delete\`, \`init\`)
  gain "AI agents:" paragraphs in their cobra Long descriptions so
  guidance shows in --help.

format.Envelope schema additions:
  Risk    per-operation classification (read / write / high-risk-write +
          action description), populated by write commands on both success
          and failure paths.
  Notice  system advisories (CLI update available, server-CLI version
          skew); type defined, emit sites land in v0.3.
  DryRun  marker for envelopes returned from --dry-run preview paths.

  RiskLevel constants realigned to lark's taxonomy: read / write /
  high-risk-write (was: read / mutating / destructive — not yet wired by
  any command).

  cmdutil.Error gains OperationRisk; PrintErrorEnvelope auto-attaches it
  to envelope.Risk so destructive failure paths surface uniformly.

Exit-10 confirmation protocol:
  New ErrorCode \`input.confirmation_required\` mapped to exit code 10 in
  cmdutil.ExitCode. ConfirmDestructive now returns this code (with
  OperationRisk attached) when stdout is non-TTY or --json was set, with
  -y/--yes absent. Previous behavior — silent proceed in non-TTY — was
  unsafe: scripts and agents could delete resources with no explicit
  approval. Three test cases re-pinned around the new contract.

  This is a wire-contract change for any caller who relied on silent
  proceed; v0.0/v0.1 had no destructive commands, so the blast radius is
  contained to v0.2 itself.

--dry-run global flag:
  cmd write paths (kb create/delete, doc upload/delete, api POST/PUT/PATCH/
  DELETE) check cmdutil.IsDryRun(cmd) and skip the SDK call, emitting an
  envelope with dry_run=true plus a Risk classification. Read commands
  ignore --dry-run by design (no side effect to preview). Human-mode
  prints \`[dry-run] would <action>\` to stdout.

Command discovery: agents introspect via the existing \`--help\` surface
(consistent with gh / kubectl / aws / gcloud / terraform — none of them
ship a CLI-tree self-description command). An earlier draft added a
\`weknora schema\` reflection command; dropped after a mainstream survey
found it has no stable analog (lark-cli's schema describes Lark API
methods, not its own CLI tree).

Tests: 27 cli packages pass at this commit. Added two new tests covering
envelope.risk and envelope._notice serialization.

cli/cmd/api/api.go

@@ -30,6 +30,8 @@ type Options struct {
 	Data     string
 	DataFile string
 	JSONOut  bool
+	DryRun   bool
+	Yes      bool
 }
 
 // Service is the narrow SDK surface this command depends on. The production
@@ -58,6 +60,20 @@ Examples:
   weknora api DELETE /api/v1/knowledge-bases/kb_xxx`,
 		Args: cobra.ExactArgs(2),
 		RunE: func(c *cobra.Command, args []string) error {
+			opts.DryRun = cmdutil.IsDryRun(c)
+			opts.Yes, _ = c.Flags().GetBool("yes")
+			method := strings.ToUpper(args[0])
+			// Escape-hatch DELETE through `weknora api` is just as destructive
+			// as `weknora kb delete` — exit-10 protocol must apply (AGENTS.md).
+			// Dry-run is read-only preview, so it skips confirmation.
+			if !opts.DryRun && method == "DELETE" {
+				if err := cmdutil.ConfirmDestructive(f.Prompter(), opts.Yes, opts.JSONOut, "endpoint", args[1]); err != nil {
+					return err
+				}
+			}
+			if opts.DryRun {
+				return runAPI(c.Context(), opts, nil, args[0], args[1])
+			}
 			cli, err := f.Client()
 			if err != nil {
 				return err
@@ -100,6 +116,21 @@ func runAPI(ctx context.Context, opts *Options, svc Service, methodArg, path str
 		body = json.RawMessage(contents)
 	}
 
+	// --dry-run only meaningful for write methods; GET/HEAD have no side
+	// effect to preview, so we proceed normally even with --dry-run.
+	if opts.DryRun && method != "GET" && method != "HEAD" {
+		level := format.RiskWrite
+		if method == "DELETE" {
+			level = format.RiskHighRiskWrite
+		}
+		preview := map[string]any{"method": method, "path": path}
+		if body != nil {
+			preview["body"] = body
+		}
+		return cmdutil.EmitDryRun(opts.JSONOut, preview, nil,
+			&format.Risk{Level: level, Action: fmt.Sprintf("%s %s", method, path)})
+	}
+
 	resp, err := svc.Raw(ctx, method, path, body)
 	if err != nil {
 		// Transport / DNS failure (Raw never returns a typed HTTP error of its