[FLO-3.7] Ship the supported Flow CLI and close the vertical slice

[szmyty]

Parent: #3
Suite roadmap: #11
Depends on: #31, #49, #50, #51, and #52

Outcome

Ship one supported Flow CLI that carries a request through inspect, plan, authority review, execution, validation, status, and recovery using the same durable contracts as the library API.

Acceptance criteria

• Provide stable doctor, inspect, plan, run, status, and resume command surfaces with structured-output modes.
• Make effect class, requested authority, provider selection/version, inputs, outputs, and expected side effects visible before execution.
• Require explicit approval for effectful operations and preserve the approval in durable evidence.
• Resume only when persisted identity and provider evidence remain valid; otherwise fail with a typed explanation.
• Make cancellation, partial completion, validation failure, and recovery actions inspectable.
• Keep exit codes, diagnostics, schemas, help, examples, and generated documentation synchronized.
• Prove one read-only Optiflow route and one deterministic Renderflow publication route from a clean install; add the Aniflow route when its immutable release is available.
• Add cross-platform smoke tests and a bounded end-to-end vertical-slice fixture.
• Close the remaining acceptance criteria under Implement a versioned cross-holon orchestration vertical slice #3 with links to immutable evidence.

Non-goals

• A GUI or daemon.
• Hidden provider installation.
• Automatic approval of destructive/effectful work.
• Distributed execution.