Add SSH management environment and CLI

[blaubaer]

Summary

Add a restricted SSH management environment and a unified local/remote administration CLI. The command layer has been rebuilt on github.com/echocat/cli4g v0.1.4: executable and management each have one compiled, reusable application definition. Options, authorization, transport dependencies and stdio are bound separately to each invocation through its context.

Command architecture

• All user-facing audit operations live under audit, alongside session, flow, recording, and version. The management application registers only these five subjects; executable-only commands never appear in its schema.
• Command registrations and typed option mixins live under pkg/cli; old Kingpin registrations, global remote option pointers, and pkg/management are gone. The separate cmd/build tool remains independent.
• Audit and Recording commands are consolidated into coherent packages. Shared rendering and output formats live in pkg/cli/format, wire protocol code in pkg/cli/transport, and transfer DTOs in pkg/cli/model.
• Both applications are created once and closed after use. The running service borrows the management application without importing the executable CLI registry. cli4g.ContextWithStdio binds stdout, stderr and stdin to the process or SSH session per invocation, including parsing and lifecycle hooks.
• --format=cbor on the public CLI emits the unframed result. Only the internal SSH exchange uses the bounded, versioned CBOR envelope. Audit event time filters use typed RFC3339 timestamps and cli4g enum support handles output formats.

Security and behavior

• SSH flow authentication and explicit management-environment authorization are unchanged. Management has no shell, SFTP, forwarding, or host command access.
• Flow configuration strings, including potentially confidential image references, remain redacted unless the management flow enables includingCredentials. Raw signed artifacts and sensitive direct SSH output require allowArtifactTransfer: true (default: false).
• Remote audit and Recording artifacts are verified against independently trusted producer IDs. Decryption identities remain on the client; SSH agents are used only for login. The integrated SSH client verifies known_hosts and supports Unix/Windows OpenSSH agents and Windows Pageant.
• The leading @[USER@]HOST[:PORT] selects remote execution; file inputs remain local and incompatible options fail explicitly. Existing protected output-path checks and signed artifact formats are retained.

Verification

• go test ./...
• Targeted go test -race for concurrent, repeated management invocations and SSH/service/CLI commands
• Windows build and vet; Linux, Windows and Darwin golangci-lint (0 issues each)
• mkdocs build --strict; go mod tidy -diff
• In-process management SSH and client tests cover signed artifacts, permission-denied transfers, private-key boundaries, concurrent invocation state and separate stdio.
• mise x -- go run ./cmd/bifroest session -c var/configuration.yaml ls executes successfully with the new CLI.

This PR remains a draft. CI for commit b6abd92 is running. The real PuTTY Pageant runtime test still requires an available Windows host with Pageant running. The intentionally ignored local implementation log is var/Management-Environment.md.