Reduce CLI overhead and protect checkout updates

[Mathih13]

Checkout updates could discard clean local commits, while package commands performed module builds and publication for changes that did not need them. This change protects local work and narrows those operations.

• Ordinary update refuses commits absent from origin/main. Explicit --reset-mirror retains the prior revision on a recovery branch; both modes protect tracked edits and conflicting untracked/ignored files across the entire repository. Existing recovery branches are never overwritten.
• Move host reconciliation to lyracore-ops service reconcile. It uses the selected Core checkout without fetching or resetting it. The old developer command returns migration guidance.
• Skip Bun/schema work for empty package builds and schema/typecheck work for runtime-script-only builds. Updates to disabled or client-only packages skip module preflight, with rollback retained for applicable failures.
• Share full and focused help through one catalogue, verify the documented command list against it, remove unsupported account-command documentation, and consolidate the README into the detailed reference.
• Bound default logs to 100 lines/64 KiB, stream full logs with --all, and clarify that re-enabling source does not restore torn-down data.
• Add CLI CI checks for tests, formatting, Clippy and Rust 1.85 support.

Compatibility: host operators must install the separate ops binary (documented in docs/operations.md). Rewritten mirror history now requires the explicit reset flag. No dependencies were added.

Retained checks: artifact canonicalization, detailed import assertions and the Loot Roll upgrade guard remain. Removing them safely requires replacement Core interfaces and an upgrade-support decision; docs/contract-ownership.md records those prerequisites. This PR does not claim to complete that cross-repository extraction. Rust publication remains inventory-wide because an offline disable leaves no remote teardown record and may still require code removal.

Validation: 804 unit tests and 9 integration tests pass, including actual CLI execution against disposable local Git repositories and focused help outside a checkout. cargo +1.93.0 fmt --all --check, Clippy with -D warnings, Rust 1.85 all-target checking, the prune shell tests, and all 15 Python deployment tests pass. No live realm or host service was changed.

Adversarial review: two independent review passes plus direct Git probes identified and resolved recovery-branch overwrite, nested-workspace ignored-file loss, and skipped publication after offline Rust-package disable. Regression coverage exercises each case.

Integrated the generated-bindings command from main into the shared help catalogue and concise README. The combined tree passes 813 Rust tests, formatting, strict Clippy and Rust 1.85 checks; independent integration review found no remaining regressions.