aimux-cli follow-ups (RFC-0025): online mode and replay subcommand

[eric8810]

RFC-0025 (aimux-cli) shipped its first version scoped to cache probing: offline + session + provider. Two capabilities were explicitly deferred and nothing tracks them:

1. online mode (attach to a live process). The RFC notes the friction honestly — aimux is a library, not a service, so there is no resident process for the CLI to attach to. Landing this needs a design decision first (e.g. dump-on-signal, sidecar, or RingRecorder export via FFI), not just code.
2. replay subcommand. Deferred as "consumption of RFC-0023". It should wait for Complete recording and replay (RFC-0023): protocol-generic replay, one record format, all bindings #167 (transport-level replay covering all protocols), otherwise it inherits the same OpenAI-only limitation the current MockReplayModel has.