feat(cli)!: remove --dry-run; a change without --execute is the preview

[thebrandonlucas]

Stack: master ← #20 ← #22 ← #24 ← #19 ← #26 ← #27 ← #28 ← #29 ← #30 ← this PR.

Responds to tee8z's question on #20: if changes are described by default, why have both --dry-run and --execute?

Problem

For a change, --dry-run and "no --execute" printed the same description, offline and without credentials. The other differences did not need a flag:

--dry-run did	Without it
Described a change offline, without credentials	A change without --execute already does
Overrode an exported VOLTAGE_EXECUTE=1	VOLTAGE_EXECUTE=0 for one command
Kept pickers from asking	--no-input or --json
Exited 0	Exit code 6 means "described, not sent", which is what a script checks
Described reads offline	Reads are safe to run; little use

Change

One rule: reads run, and changes are described (exit 6) unless --execute asks to send them.

• -n/--dry-run are removed. They were never released (not in v0.1.0), so the changelog's Unreleased line is corrected; no "Removed" entry is needed.
• The description and its outcome: dry_run envelope are unchanged.
• Help examples and docs show a preview as the same command without --execute (for example, wallets delete).
• The documented-example test accepts a change without --execute only when the same command is also documented with --execute, so a forgotten --execute still fails. I checked this by adding an unmatched line, which failed as expected.
• The docs: add wallet and webhook guides and dry-run every documented change #26 and test(cli): run every help example that sends a change as an offline dry run #30 offline example tests now expect exit 6 instead of exit 0.
• The safety model starts with a table of reads, changes, and --execute. It also says that a picker can still list choices from the API on a terminal; pass the scope, --no-input, or --json to stay offline.
• A test that previewed two checkout reads is replaced by one that sends a real session read and checks its Origin header. The stream test already covers the stream's header.

Validation

cargo fmt --check, cargo clippy --locked --all-targets -- -D warnings, cargo test --locked (99 unit, 72 integration), and python3 scripts/check-coverage.py pass. global-flags.md is unchanged, because --dry-run was a per-command flag. On the built binary, wallets delete without --execute exits 6 with outcome: dry_run, and --dry-run exits 2 as an unknown argument.

Limits

• cargo machete is not installed locally; dependencies are unchanged.
• A described change no longer exits 0. A script that previews on purpose must treat exit code 6 as success.