Insights v2: expose recommendations in CI and offline CLI

[zroubalik]

Parent: Insights & FinOps v2
Phase: Connected read/CI output and offline CLI
Dependencies: shared public engine from API#495; source adapters and cross-component tests from agent#618.

Why

Teams should inspect recommendations in CI/CD and GitOps and run the same analysis in disconnected environments using one public Kedify CLI binary.

Connected read and CI

• Provide list/show commands with JSON and a concise table containing identity, target, evidence, policy, data quality, blocked reason, and impact/provenance.
• Follow agent#652 — base Insights, KSM enrichment and standard metric names: display available findings plus per-finding source/coverage and missing prerequisites. No-KSM inputs can yield base Insights; KSM enriches supported state, while CFS/JVM and other runtime evidence have independent requirements. Missing evaluation evidence must not become a passing CI gate.
• Fetch all requested pages. Keep machine output on stdout and diagnostics on stderr. Define non-interactive exit codes and configurable confidence/risk gates. Reading and CI must never mutate by default.
• Preserve the API result contract rather than introducing a CLI-specific result model. Defer SARIF until the JSON contract is in use and a real integration needs it.
• Export one explicitly selected target using API#500's patch artifact. Do not build batch patching or multiple output-format frameworks.

Offline analysis

• Import the public github.com/kedify/recommender/analysis package directly and call it in-process. CLI#15 supplies the normalized snapshot entry point.
• Keep the CLI as one binary. Do not require a helper executable, process protocol, private Go module access, runtime download, Kedify login, or SaaS connection.
• Reuse #618 adapters for native-base or KSM-enriched normalized snapshots and verified local Prometheus/history plus authoritative inventory inputs. Preserve workload/revision/container identity, units, source/coverage and missing-data state. Native agent bundles are not automatically available on local /metrics; capture/export equivalent observations or report the missing capability without adding a broad duplicate collector.
• Produce the same versioned result content as connected analysis. Unsupported input versions and insufficient evidence must be explicit.
• Document a practical CI flow and a network-isolated offline flow. A no-install assessment still requires an existing metric source with enough history.

Acceptance criteria

• Connected JSON/table output, pagination, stdout/stderr behavior, and CI gates are tested and read-only by default.
• A clean public build through the public Go proxy produces one CLI binary with the public engine linked in.
• The CLI analyzes a normalized snapshot with networking disabled and local Prometheus/Kubernetes data with egress restricted to those declared sources.
• Connected and offline analysis of the same normalized input produce equivalent engine version, values, evidence, policy, and data quality.
• No-KSM base, enriched, missing-runtime and source-outage cases expose the same available/blocked findings as the API. Missing history, inventory, ownership or required safety evidence cannot pass a CI gate or produce unsafe sizing; incompatible schemas return actionable errors.
• Guarded apply, when added, uses #500 and revalidates the reviewed artifact; it does not delay read/CI/offline delivery.

Outcome

One public command surface supports connected reports, CI gates, and real offline analysis without duplicating recommendation logic or shipping another runtime.