refactor(cli): delete envelope infrastructure, errors to stderr

Removes the entire envelope machinery now that every success path
emits bare JSON:

- cli/internal/format/envelope.go (Envelope, Success, Failure,
  SuccessWithRisk, WriteEnvelope, Meta, Notice, UpdateNotice,
  VersionSkewNotice, Risk, RiskLevel, ErrorBody) + tests.
- cli/internal/format/filter.go envelope-specific helpers
  (WriteEnvelopeFiltered, marshalEnvelope, applyFieldFilter,
  filterDataPayload, filterObjectData); the reusable
  filterArrayItems / filterObjectKeys / writeJQ stay for bare.go.
- cli/internal/cmdutil/exporter.go + tests (envelope-only).
- cli/internal/cmdutil/PrintErrorEnvelope + ToErrorBody +
  operationRiskOf + Error.OperationRisk field + OperationRisk struct.

Error path: all errors now go to stderr via cmdutil.PrintError in
`code: message\nhint: ...` form, regardless of --json. Stdout stays
empty (or holds the partial-success the command already wrote) so
downstream `--json | jq` pipelines never have to filter error shapes
out of the success stream. Typed exit codes (3 auth.* / 4
resource.not_found / 5 input.* / 6 server.rate_limited / 7 server.*
+ network.* / 10 input.confirmation_required) carry the failure
class for agents that branch on it.

Acceptance contract:
- envelope_test.go → wire_test.go (TestEnvelopeGolden → TestWireGolden).
- testdata/envelopes/ → testdata/wire/.
- Error-path cases assert the typed code substring on stderr.
- Orphan whoami.*.json goldens deleted.

AGENTS.md + README.md rewritten for the bare-data contract:
- Drop envelope schema section + dry-run rule.
- Document bare JSON on stdout + `code: msg\nhint: …` on stderr.
- ADR-3 reframed around bare data and why error separation matters
  for `--json | jq` pipelines.

WriteJSONFiltered short-circuits to WriteJSON when both filters are
empty (skip the marshal-buffer round-trip for the common case).

Final review pass:
- Fix wire-contract bug: `--json id,name` (space form) is broken by
  pflag's NoOptDefVal; AGENTS.md / README.md / SetAgentHelp + the
  field-discovery help text all switched to `--json=id,name`.
- Fix `weknora api --jq` silently ignored: api.go now routes through
  WriteJSONFiltered with jopts.JQ.
- AGENTS.md: drop the false claim that `auth logout` honors `-y`
  (logout is local-only with no ConfirmDestructive guard); list the
  actual destructive commands instead.
- Rewrite cli/acceptance/e2e/e2e_test.go for the bare-data wire shape
  (was still parsing `out["data"]` / `env["ok"]`).
- Add `JSONOptions.Emit(w, v)` helper; collapse ~33 repeated
  `format.WriteJSONFiltered(iostreams.IO.Out, X, jopts.Fields,
  jopts.JQ)` sites to `jopts.Emit(iostreams.IO.Out, X)` — drops the
  format import from 22 cmd/* files.
- Delete single-caller `cmdutil.MustRequireFlag`; inline as
  `_ = cmd.MarkFlagRequired(...)` everywhere.
- Add `_ = cmd.MarkFlagRequired("name")` to `kb create`; it was the
  only write command relying on runtime --name validation while
  `context add` already used the cobra-level mark.
- `context use`: register `--json` / `--jq` (was always emitting JSON
  unconditionally with no human path and no flag — diverged from
  every other write command); human mode now prints
  `✓ Switched context to X (was Y)`.
- Replace per-package `confirmPrompter` / `scriptedConfirm` /
  `errPrompter` test doubles with `testutil.ConfirmPrompter`.
- Rename `chatService` → `ChatService` (export to match siblings
  `ListService` / `ViewService`); rename `printUploadSuccess` →
  `renderUploadSuccess` (siblings use `render*`).
- `defaultHint(CodeResourceNotFound)`: drop the hardcoded
  "list available with `weknora kb list`" — misleading on agent /
  doc / session 404. Replaced with "verify the resource ID and try
  again".
- Strip stale `v0.2/v0.3` / "envelope" / "v0.0/v0.1 supports only"
  historical tags from production comments and a few test
  descriptions.

cli/README.md

@@ -25,8 +25,9 @@ Available Commands:
 
 The command surface mirrors `gh` CLI's `<noun> <verb>` convention. See
 [AGENTS.md](AGENTS.md) for the operational contract that AI agents
-(Claude Code, Cursor, Aider, …) can rely on: envelope schema, exit-code
-protocol, error-code registry, and per-command guidance.
+(Claude Code, Cursor, Aider, …) can rely on: bare-JSON output shape,
+stderr error format, exit-code protocol, error-code registry, and
+per-command guidance.
 
 ---
 
@@ -105,33 +106,30 @@ weknora auth logout --all
 
 ---
 
-## JSON envelope output
+## JSON output
 
-Every command supports `--json`, returning a stable envelope shape:
+Every command supports `--json`, emitting bare JSON for the resource it
+produces — an array for `list` / `search`, a single object for `view`
+and write outcomes:
 
-```json
-{
-  "ok": true,
-  "data": { /* command-specific payload */ },
-  "_meta": { "context": "prod", "kb_id": "a32a63ff-fb36-4874-bcaa-30f48570a694" }
-}
+```bash
+weknora kb list --json                        # [{ "id": "kb_x", "name": "Eng" }, …]
+weknora kb view kb_x --json                   # { "id": "kb_x", "name": "Eng", … }
+weknora kb list --json=id,name                # project to listed fields
+weknora kb list --json --jq '.[].id'          # jq over the bare data
 ```
 
-On error:
+On failure, stdout stays empty and the typed error goes to stderr in
+`code: message\nhint: ...` form:
 
-```json
-{
-  "ok": false,
-  "error": {
-    "code": "auth.unauthenticated",
-    "message": "...",
-    "hint": "run `weknora auth login`"
-  }
-}
+```
+auth.unauthenticated: fetch current user: HTTP error 401: ...
+hint: run `weknora auth login`
 ```
 
-The full schema, error-code registry, and exit-code protocol (0 / 1 / 2 / 10
-/ 130) are documented in [AGENTS.md](AGENTS.md).
+The typed exit code (3 / 4 / 5 / 6 / 7 / 10) carries the failure
+class for agents that branch on it. The full error-code registry and
+exit-code protocol are documented in [AGENTS.md](AGENTS.md).
 
 ---