Narrow CLI command runtime protocols and enforce boundary contracts

[sg4tech]

Summary

• Replace broad command handler runtime dependencies with operation-specific protocols
• Add concrete return types and Semgrep rules for runtime boundary enforcement
• Add static facade-to-protocol contract checks
• Update architecture documentation and formatting

Testing

Not run (not requested).