feat(filesystem): symlink / chown / ssl write helpers

[chmmou]

Vertical-slice (per kasapi-cli-vertical-slice SKILL) for the filesystem helpers that don't fit into a CRUD-shaped resource. Subset of #13.

KAS actions in scope

• add_symlink
• update_chown
• update_ssl

Notes

• Fixtures already in testdata/filesystem/ (or per-action subfolders — PR test: restructure KAS API fixtures into per-package folders #22).
• All three are destructive / state-mutating and depend on the confirmation infrastructure in feat(cli): destructive-write confirmation infrastructure (--yes / interactive prompt) #109. update_chown warrants a loud prompt because permission changes are easy to mis-target.
• These actions don't share a natural Go-package home; pick a sensible grouping (e.g. internal/filesystem/) or split into per-action packages during slice design.
• No matching read counterparts — these are write-only.

Acceptance

• SOAP request encoders + per-action mappings (location to be chosen during slice design)
• *Client write methods + per-package Caller interface tests
• CLI subcommands wired and registered in cmd/kasapi-cli/main.go
• make docs regenerated and committed
• CHANGELOG ### Added entry
• PR references this issue with Closes #<n>

Parent: #13