fix(report): keep issue filing dry-run unless --yes is passed

[CoreyRDean]

Non-technical summary

i report was writing to GitHub by default as soon as a user confirmed an interactive prompt, even though the spec says the command should stay in dry-run mode unless --yes is passed. This change restores that contract so users can inspect proposed issue/comment actions without mutating GitHub unless they explicitly opt into execution.

This matters now because report is one of the repo's most safety-sensitive subcommands: it bridges natural language into external writes. After this change, the default path is once again non-mutating and the mutating path is explicit.

Technical summary

• extracted the final proposal-application loop into applyReportMatches so the write gate is isolated and testable
• changed duplicate handling to remain preview-only without --yes, instead of posting comments after an interactive confirmation
• changed new-issue handling to remain preview-only without --yes, while still showing filtered labels and body previews
• kept --yes as the execution gate for both comment and create paths
• added regression tests covering:
  • no write callbacks in dry-run mode
  • preserved write behavior when --yes is present
  • output and label-filtering behavior in both modes

Relevant intent being strengthened: docs/SPEC.md section 10, which says i report is dry-run by default unless --yes is passed.

Tests:

• PATH="/opt/homebrew/bin:$PATH" go test ./internal/cli/...
• PATH="/opt/homebrew/bin:$PATH" go test ./...
• PATH="/opt/homebrew/bin:$PATH" go vet ./...
• PATH="/opt/homebrew/bin:$PATH" make build

Breaking changes: behaviorally, yes for anyone relying on interactive default writes from i report, but this is an intentional spec-alignment correction on main rather than a new contract.

Additional notes

Trade-off: this removes a convenience path for interactive report filing, but that path was violating the documented safety boundary.

Intentionally deferred:

• the synthesized-fallback path in offerSynthesizedProposal, which still has its own degraded confirmation UX and may deserve a follow-up alignment pass
• broader report ergonomics or GitHub transport changes outside the default dry-run contract

Remaining gap to the fuller vision: report still depends on gh CLI availability and has some fallback UX edges, but the default mutation boundary now matches the published spec again.