refactor(cli): extract command bodies into the shared service layer (#387 C1)

[eaitbrahim]

C1 of the TUI-operator-console PRD (§5): O2 — one implementation, two front-ends. Every CLI command body in keel/cli.py that carried logic now delegates to a service in keel/commands/*; the wrapper parses click options, builds the broker lazily at the _build_broker seam, calls the service, and prints/raises. keel/cli.py shrinks by ~1280 net lines and gains no behavior.

Audit → destination

command	class	shared implementation
fetch	(b) extracted	new keel/commands/fetch.py — assess_products (window-bounded sweep), render_freshness, run_fetch (check/skip/warm/repair flow, FetchResult)
monitor	(b) extracted	new keel/commands/monitor.py — monitor_cycle, run_monitor (FR-9 session-aware loop, once-per-state-change skip lines)
simulate	(b) extracted	new keel/commands/simulate.py — run_simulation + the whole assembly (candles, #259 slippage pass, account metrics, tier matrix, verdict, trials row, report/artifact write)
assets screen / holdings / discover	(b) extracted	new keel/commands/assets.py — screen_product (THE admission gate), market_facts, VENUE, gather_holdings+render_holdings, run_discovery+render_discover, screen_products, broker_auth_hint
agent's confirm gate	(b) extracted	new keel/commands/confirm.py — _interactive_confirm, preview reading/rendering, all markers
kill / resume / resume-entries / record-flow / reset-hwm	(b) extracted	new keel/commands/trading.py — the state mutations + render_loop_result (typed prompts stay front-side per O3)
pnl	(b) extracted	new keel/commands/pnl.py — build_pnl_report + render_pnl_report
purification	(b) renderer extracted	new keel/commands/purification.py — render only; compute was already keel.compliance.purification
db trials withdrawals autonomy rules subscription status insights versions tui	(a) already shared	keel/commands/* modules; keel.agent; keel.data.*
assets attest/attest-instrument/exempt/unexempt/list/propose	(a) already shared	Repository writes / keel.proposer
agent cycle/loop	(a) already shared	keel.agent.run_once/loop
init / init-config / migrate	(a) — deliberately NOT extracted	template read + keel.data.db.migrate; scaffolding ops absent from the TUI menu tree

Also: keel/commands/admission.py now imports the discovery defaults from keel/commands/assets.py instead of mirroring the CLI options by hand (one home for DEFAULT_MIN_QUOTE_24H_VOLUME / DEFAULT_DISCOVER_LIMIT), and keel/commands/tui.py's two lazy from keel.cli import _screen_product imports now come from the service layer — no cycle dodge left.

Byte-compatibility guarantee

Same output strings, exit codes, error messages, log events and echo order — services stream progress through injected echo/echo_err callables the wrappers point at click.echo. Broker construction stays lazy via build_client factories (--check, --no-fetch and the all-current skip still never construct a broker). Every name the existing tests pin through keel.cli (_screen_product, _assess_products, _SIM_SLIPPAGE_PCT, _interactive_confirm + the preview markers, the history_mod/repair_mod patch aliases) is a re-import of the same service object, not a copy. The pre-existing suite passes unchanged — zero test files modified.

Parity + architecture pins (new tests)

• tests/commands/test_service_parity.py (19 tests): for each extracted operation, a CLI invocation and a direct service call over the same fixtures produce identical stdout (modulo the CLI's own disclaimer footer), identical report files (simulate), identical agent_state (trading mutations), identical verdicts (assets screen), plus object-identity assertions for every re-exported name.
• tests/commands/test_service_isolation.py (2 tests): a fresh interpreter imports every service module and keel.commands.tui without keel.cli appearing in sys.modules; an AST scan pins that no keel/commands/* module imports the composition root at module load.

Gates

• uv run pytest -q — 3262 passed, 2 skipped
• uv run ruff check keel tests packages — clean
• uv run mypy — clean

Fixes #387