Insights v2: expose recommendations in CI and offline CLI #14

Summary

Make one public CLI show trustworthy connected Insights, gate CI, and analyze captured or local evidence without Kedify SaaS.

ASD-STE100 summary

The CLI reads current connected recommendations with evidence and quality.
It analyzes captured or declared local inputs through the same released engine, without SaaS.

Parent: Insights & FinOps v2. Shared CLI delivery for all three pillars, including GPU and JVM.

Scope and acceptance

• List and show current recommendations as complete JSON and a concise table with target identity, source, evidence, quality, policy, blocked reason, and impact; fetch every page.
• Provide read-only CI thresholds and non-interactive exit codes; missing or unsupported evidence cannot pass. Keep machine output on stdout and diagnostics on stderr.
• Pin the same supported released public engine version as Dashboard API. Reject unsupported schemas and prove connected/offline parity on the same normalized fixture, including identity, values, policy, evidence, and quality.
• Ship a publicly installable single binary that analyzes a captured snapshot with networking disabled and local history with egress limited to declared sources. No Kedify login, private module, helper executable, or runtime download is required.
• Show missing history, workload UID/revision, inventory, OOM or runtime evidence as scoped blocked/unavailable results. KSM is a fallback for missing offline native state only; its presence does not imply full detector coverage.

Implementation/dependencies: agent#618 owns snapshot capture and local Prometheus/Kubernetes adapters; this issue owns commands, reporting, CI gates, packaging, and release tests.