fix(commands): close requires_auth() fail-open gap in 19 CommandHandler impls

[bug-ops]

Summary

• Third confirmed instance of the CommandHandler::requires_auth() fail-open-by-default defect class, after /image (SECURITY: /image command allows unauthenticated remote users (Telegram/Discord/Slack) to read arbitrary files under the server's working directory #5967/fix(commands): require trusted session for /image path reads #5988) and /mcp+/plugins (SECURITY: /mcp add allows unauthenticated remote code execution via missing requires_auth (default-config exploitable); /plugins add has the same gap #5997/fix(commands): require trusted session for /mcp and /plugins #6002).
• Audited all 50 impl CommandHandler blocks in crates/zeph-commands/src/handlers/ and added requires_auth() -> true to the 19 that mutate local filesystem/process/config state, spawn processes, or disclose sensitive configuration: UndoCommand, RedoCommand, PlanCommand, SkillCommand, KnowledgeSlashCommand, AgentCommand, AgentsFleetCommand, ConvCommand, MemoryCommand, GraphCommand, GoalCommand, AcpCommand, CompactCommand, FeedbackCommand, CocoonCommand, NewConversationCommand, ClearCommand, ResetCommand, ClearQueueCommand.
• RecapCommand, SkillsCommand, GuidelinesCommand, ExitCommand, QuitCommand, HelpCommand audited and confirmed safe (read-only or self-gated via supports_exit()); left unchanged.
• The trait's fail-open default itself is unchanged — flipping it to fail-closed is a separate architectural decision, deferred to a follow-up issue.

Test plan

• cargo nextest run --config-file .github/nextest.toml -p zeph-commands --all-features — 177/177 passed, including one dispatch-level allowed/rejected test pair per gated handler (or direct unit assert for acp.rs/cocoon.rs, matching each file's existing test convention).
• cargo +nightly fmt --check — clean.
• cargo clippy --profile ci --workspace --all-targets --features "desktop,ide,server,chat,pdf,scheduler,testing" -- -D warnings — clean.
• RUSTDOCFLAGS="--deny rustdoc::broken_intra_doc_links" cargo doc --no-deps --all-features -p zeph-commands and cargo test --doc -p zeph-commands --all-features — clean.
• Independent adversarial critique (impl-critic): re-verified sweep completeness (all 50 handlers enumerated), trust-gate propagation across both dispatch paths, test-assertion quality (keys on the gate-exclusive error string, no false positives), scope-boundary correctness for the 6 ungated handlers, and feature-gate compile correctness under single-feature builds (--features cocoon). Verdict: approved, no blocking findings.
• Independent code review: approved, no blocking findings.
• Live untrusted-channel rejection (Telegram/Discord/Slack) not exercised — same limitation as the two prior fixes in this class (requires live bot credentials, unavailable in CI). Tracked in .local/testing/coverage-status.md.