feat: migrate flashduty-cli onto go-flashduty (covered+non-enriched, dual-client)

[ysyneu]

What

Begin migrating flashduty-cli off the hand-written flashduty-sdk onto the generated go-flashduty client. Behavior-preserving, dual-client transition: go.mod requires both SDKs; migrated handlers call *go-flashduty.Client (wired via RunContext.GFClient / newGFClientFn); every deferred handler keeps an in-code TODO(go-flashduty migration) naming exactly why it stays on legacy.

This is the CLI counterpart to flashduty-mcp-server#61 (same dual-client pattern, same go-flashduty v0.3.0).

Migrated (28 commands)

• incident batch ops: ack, unack, close→Resolve, wake, merge, snooze, reopen, reassign→Assign, add-responder→ResponderAdd, comment, disable-merge, remove, create + war-room list/get/delete
• alert merge, events · alert-event list
• insight team, channel, responder, top-alerts
• audit search · statuspage create-timeline · monit-query diagnose · monit-agent catalog, invoke

Deferred on legacy SDK (each TODO-annotated)

• endpoint gap (pending upstream): war-room create / add-member / default-observers, change list/trend, statuspage list, insight notifications, mcp create
• shape / enrichment divergence: incident list/get/timeline/feed/similar/postmortem, alert list/get/timeline, oncall who/schedule, statuspage changes/create-incident, incident update (/incident/reset drops --field), monit-query rows (raw-bytes→structured)

The migration map's "covered" means the endpoint exists — not that the request shape is compatible. Several map-"covered" commands are structurally divergent or enrichment-dependent and were deliberately deferred rather than force-fit.

Other changes

• TOON moved from sdk.Marshal(.., TOON) to toon-go directly (promoted to a direct dep); the SDK stays a pure client.
• Test seam: go-flashduty's client is a concrete type (not an interface), so migrated-command tests run against gfStub — an httptest server that records path + decoded body and replies with a canned envelope (internal/cli/gfstub_test.go).
• Exact legacy wire on assignment: both incident create and incident reassign set assigned_to.type = "assign" explicitly. The hand-written SDK forced it; leaving it empty would let the backend relabel an already-assigned incident as reassign in the feed/IM cards. Guarded by two new wire-assertion tests. (Whether reassign should say "reassign" is a separate product decision, intentionally not bundled here.)

Verification

• go build + go test (all 6 packages) + go vet + gofmt -l clean.
• In-process e2e against api-dev passes for migrated commands with coverage. Remaining e2e failures reproduce identically on a clean origin/main baseline (stale --title flag tests, 31-day-window / 429 / 401-override-key env issues, and the not-migrated change list) — pre-existing, not introduced here.

Follow-up (blocked on upstream)

Once the gap endpoints are documented upstream → re-vendored into go-flashduty → released, switch the deferred handlers off legacy and drop the flashduty-sdk dep. Same convergence as the MCP PR.