feat: add Agent Community CLI

[nembal]

What changed

• adds seven read-only Agent Community commands plus guarded batch execution
• adds path-correct service authorization login, live status/refresh, local logout, and RFC 7009 access-token revoke
• pins the immutable PAGE 1.0.0 contract bundle and fails closed on drift
• adds a useful root AGENTS.md, package/security metadata, and six-job macOS/Linux CI

Why

This is the public, inspectable CLI and agent-rules repository required for Agent Community developer access and the remaining Ora code-based usability evidence.

Safety

The CLI does not expose registration or delegation mutation. No npm publication workflow, production credential, live login, deploy, or package release is included in this PR.

Verification

• independent Task 6.1 review approved after protocol fixes
• independent Task 6.2 review approved after five credential/protocol fixes
• 127/127 tests pass on supported Node 24
• lint, typecheck, build, contract compatibility, package dry-run, exact-tarball audit, and clean-install help smoke pass
• production dependency audit reports 0 vulnerabilities
• six CI jobs cover Node 22.14, 24, and 26 on Ubuntu 24.04 and macOS