* feat(cli): make import apply/commit/cancel agent-drivable

Add non-interactive support to the import lifecycle commands so a remote
agent (or CI) can reserve imported resources without a human at a TTY,
which is the CLI slice of the AI runner -> PR handoff (AI-446).

- Add `--plan-id <id>` to `import apply`, `import commit`, and `import
  cancel` to target a plan without interactive selection.
- Add `--force`/`-f` to `import apply`: apply only and skip the trailing
  "commit now?" prompt, deferring finalization to a post-merge deploy.
- In non-interactive sessions (agent/CI, via detectCliMode) a single
  candidate plan is auto-selected; an ambiguous multi-plan selection
  errors asking for `--plan-id` (exit 1). Interactive behavior is
  unchanged.
- Extract the shared resolution logic into
  helpers/import-plan-selection.ts (kept out of commands/import/ so oclif
  does not register it as a command).

All changes are additive and backwards compatible. Scoped
`import plan check:<id>` already sends a scoped filter payload, so no
change was needed there.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* feat(cli): hint at by-ID import when nothing is importable

When `checkly import` finds no importable resources, a resource the user
expected may simply be hidden because it's reserved by a pending import.
Add an info tip pointing them at the scoped `checkly import check:<id>`
form, which surfaces such resources.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* fix(cli): reject --all with --plan-id on import cancel

Making import cancel agent-drivable exposed a footgun: with both --all and
--plan-id set, --all silently won and the requested plan id was ignored.
For the one destructive command in the import set, driven by agents that
assemble flags programmatically, silently doing the opposite of an explicit
--plan-id is a hazard.

Reject the contradictory combination with a non-zero exit instead. The
--all / --plan-id resolution (plus the previously duplicated
PlanSelectionError -> exit tail) is unified into a new selectPlansOrExit
helper, and cancel's command-level wiring now has test coverage
(agent single-plan, --all, ambiguous exit 1, and the new guard).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* fix(cli): harden the non-interactive import lifecycle contract

Addresses review feedback on the agent-drivable import lifecycle.

Require explicit authorization for commit and cancel. Agent/CI detection
resolved a plan and then immediately mutated: commit permanently, cancel
by deleting. Both now take --force/--dry-run and route through
confirmOrAbort, matching `checks delete`. Agents get a JSON preview and
exit 2 until they re-run with --force. The resolved plan ID is pinned
into confirmCommand so the confirming run cannot resolve to a different
plan than the one previewed. cancel is marked destructive; commit is
deliberately not (it deletes nothing) but is still gated, as
confirmOrAbort covers every non-read-only command.

Make the failure paths honest. style.fatal only logs, so an explicit
--plan-id that could not be satisfied printed a red error and exited 0.
Flag conflicts were also detected after the fetch, so
`cancel --all --plan-id x` passed silently when zero plans existed.
Conflicts are now validated before the API call, an unsatisfiable
explicit target exits 1, and genuine nothing-to-do exits 0 with plain
informational text instead of red.

Rename apply's --force to --no-commit. forceFlag() is documented as
"Skip confirmation prompt", but on apply it returned before the commit
step — equivalent to answering "no". The deferred-commit behavior is
unchanged; only the name and help text now describe it. --force on apply
is introduced by this PR and unreleased, so this is not a breaking
rename. Applying now also prints the exact command to commit later.

List candidate plan IDs when selection is ambiguous. The error told
agents to re-run with --plan-id <id> but named no IDs, and there is no
plan listing command, so the instruction was unfollowable.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* docs(cli): document import commit/cancel in the confirmation protocol

This branch routes `import commit` and `import cancel` through
`confirmOrAbort`, so both now return exit code 2 and a
`confirmation_required` envelope in agent sessions. The protocol reference
listed the confirmation-gated write commands as a closed set —
`incidents create/update/resolve`, `deploy`, `destroy` — which no longer
matches the CLI. Add the two import commands to that list.

Also document the pinning behavior the same commands introduce. Both write
their resolved plan back into the `confirmCommand`, so a bare
`checkly import commit` confirms as:

  checkly import commit --plan-id="abc123" --force

carrying a flag the caller never passed. That is deliberate — it stops the
approved run from re-resolving to a plan the user was never shown — but it
looks like noise to an agent that assumes the confirmCommand only ever
repeats what it typed, and the reference gave it no reason to think
otherwise. Say so explicitly, and say not to strip the flag.

Reference-only change: `skills/checkly/SKILL.md` carries the action list,
not reference bodies, so no `sync:skills` regeneration is needed.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>