Complete AgentTK agent-safe CLI roadmap

[fraction12]

Summary

• complete all four phases of the AgentTK agent-safe CLI roadmap in one PR
• archive all completed OpenSpec changes into canon specs
• document the new framework surface and add checklist coverage to the testing exports

Phases included

• Phase 1, recovery semantics: machine-usable nextAction, failure classification, and retryability metadata
• Phase 2, mutation safety: retry posture, replay risk, partial outcomes, and verification status
• Phase 3, autonomy guardrails: command risk metadata and confirmation-required behavior
• Phase 4, agent-safe CLI checklist: exported downstream review bar for audits, PRs, and release gates

What changed

• added recovery metadata helpers and normalized rendering for machine-usable next actions
• added mutation safety metadata for retry posture, replay risk, partial outcomes, and verification state
• added command risk metadata plus confirmation-required guardrails and help rendering
• exported an agent-safe CLI checklist for downstream PR/release reviews
• merged the completed OpenSpec roadmap changes into canon specs and archived the change folders

Verification

• npm run build
• npm test
• npm run verify
• openspec validate --all
• npm pack --dry-run