[cli] Command coverage and dsar doctor diagnostic command

[KayleeWilliams]

Why

CLIs feel mature or abandoned largely based on --help quality and whether commands crash on edge cases. It is usually the first thing an evaluator touches. Today 11 commands exist with uneven coverage.

Scope

• Integration test per command in packages/cli/src/commands/** (audit, notifications, policies, registry, requests, retention, subjects, system, webhooks + sub-commands)
• Golden snapshots of --help output for every command
• New dsar doctor command that validates:
  • Runtime config is loadable
  • DB connection works + migrations are current
  • Each configured adapter can initialize (storage, inbound, outbound)
  • Auth provider (Unkey or local) is reachable
• Exit codes documented and tested

Priority: P1 - beta blocker