feat(cli): JSON output for switch and version

[leinardi]

Summary

Adds structured output to the two commands that lacked it, so a client — the GNOME Shell extension being built against
monmux — can read a switch's result instead of parsing prose, and writes the contract down.

• monmux version --json — {"version", "commit", "date"}, through the same JSON writer info --json uses. The prose
  output is unchanged when the flag is absent.
• monmux switch --json — one document on stdout for every outcome, with the exit code unchanged. The pair
  outcome/writeStatus is fixed: sent/sent (exit 0), dry-run/none (exit 0), refused/none (exit 2),
  failed/unknown (exit 1). The exit code stays the authority for "the write status is unknown"; the document is the
  authority for telling a dry run from a real send, which the exit code cannot. A client validates the two against each
  other and treats any other combination as a protocol error, so a dry run can never be announced as a completed switch.
• catalog list --json / catalog show --json — each entry of inputs[] gains label, the human name monmux itself
  prints (DisplayPort, HDMI 2, USB-C). info --json's enabledInputs stays a list of names: a client that wants
  labels joins on the catalog entry, where every enabled input is recorded by construction.
• docs/json.md — the whole contract, field by field: what is stable and what is prose, what redaction does to a
  document, the three shapes the version fields take across a release, a make go-build and a bare go build, and the
  scope of the switch guarantee.

What is not weakened

No fail-closed invariant moves. The text path is untouched: a refusal still exits 2 and still ends with
No DDC write was performed. A --json run that failed returns a renderedError that message() renders as nothing and
exitCode() unwraps, so the report is not printed twice and the codes are exactly the ones the text path uses. --json
adds no way to name a VCP code or a value; the bytes still come from the compiled-in catalog. Redaction is unchanged:
command, display.handle and refusal.detected are masked unless --show-serial.

assumed reports what happened rather than what was asked for — it is true exactly when the policy assumed a model,
including a bypassed write whose tool then failed, which is the one outcome where an unverified value may have reached a
monitor.

Scope of the guarantee

One document for every run that reaches the switch handler, including the argument errors it raises itself. Errors cobra
raises before it — wrong argument count, unknown flag, bad flag value — stay prose on stderr with exit 1, as for every
command, because --json has not been parsed when they occur. A client reads "exit 1 with nothing parsable on stdout" as a
failure whose text is stderr, never as a refusal.

Pull request checklist

• I am targeting the main branch
• I have rebased this branch on top of the destination branch
• I have executed make check locally before creating the commit and it has run successfully
• I have performed a self-review of my own code
• There are no WIP commits in this PR

Also run on every commit: make go-test, make go-vet-cross, make go-lint-cross (0 issues for both GOOS=linux and
GOOS=darwin).

Monitor writes

• If this changes internal/catalog/models.yaml, the evidence is in the entry, and the Summary above says which model
  and which input it enables — n/a, the catalog is untouched
• No hardware run in this pull request was performed by an AI agent — AGENTS.md

Verification was read-only throughout: monmux version --json, monmux switch dp --dry-run --json and a refusal
(monmux switch hdmi9 --json, exit 2). Nothing was written to a monitor. The new tests drive the fake backend only.

Type of changes

• 🐛 Bug fix
• ✨ New feature
• 🖥️ Catalog (a model or an input recorded, enabled or corrected)
• 🔧 Refactoring
• 📜 Docs
• 🧰 CI / tooling / infra
• Other (describe in Summary)