fix(cli): carry sdk.discovery-divergent into the text channel, and give tan run a --confirm

[alpCaner]

Summary

#799 — sdk.discovery-divergent never reached the text channel.

The warning is appended inside Envelope.__init__ (via _with_sdk_divergence), but size, image, clean, run and validate each construct the Envelope only inside their if json_mode: branch and render text from a pre-envelope issues local. So a user running any of those five without --format json was never told that two alp-sdk checkouts resolve from their directory and both report sourceTier "discovery" — the exact condition the warning exists to surface.

pinmux_cmd.py was already correct: it builds the Envelope once, unconditionally, and renders text from envelope.issues. The five commands now follow that pattern.

#809 — the README quickstart's tan run --flash could not arm the confirm gate.

The quickstart, the walkthrough step and the Common-commands table all document tan run --flash, and grep -n -i confirm README.md returned zero hits. But run had no --confirm option and never passed confirm_flag, so on an E1M-AEN801 Flow D target every slice came back planned, flash.nothing-flashed fired, and the command exited 1 — while printing a remedy whose first suggestion is --confirm on the command line, a flag tan run rejects. The only working command-line route was the separate tan flash --confirm subcommand.

run now accepts --confirm and threads it through as confirm_flag, so the printed remedy is self-consistent, and the README documents the gate at all three places. The gate itself is unchanged and still closed by default — this only gives run a way to arm it explicitly, plus honest docs. --flash's own help now names the second opt-in too, rather than promising a write it cannot perform alone.

Test plan

• python -m pytest tests/gates -q from python/: 465 passed, 9 skipped.
• Full suite FAILED-set diffed against origin/dev under identical conditions: 22 vs 22, difference empty in both directions. Collect-only diff: +10 tests, 0 removed.
• Red-green verified by reverting each production file and confirming the matching test fails: reverting run_cmd.py reddens the four new run tests plus the [run] divergence case; reverting clean_cmd/image_cmd/size_cmd/validate_cmd reddens [clean] [image] [size] [validate].
• python python/scripts/assemble_changelog.py --check now lists both fragments (7 pending).

Two defects caught in review, recorded because they were nearly shipped

Both were tests that could not fail — worth knowing about, since one was on a flash-path flag:

1. The first revision's "warning:" assertion shipped red for the validate parametrization: the other four commands print f"{issue.severity}: {issue.message}" but validate_cmd wrote a bare f"{issue.message}". Fixed by giving validate's seam-added sdk.* lines the severity prefix, so all five commands are consistent.
2. The --confirm-on-help assertion was vacuous — deleting the entire typer.Option(False, "--confirm", …) block and the call-site forward left it green, because the amended --flash help text itself contains the literal string --confirm. It now asserts against the real parser, verified red-green by removing the option and watching it fail.

Closes #799.
Closes #809.