G1. Dry-run mode #156

Why

Production accounts appear in telemetry. A --dry-run lets agents and automation preview mutations (what would be created/replaced/deleted, estimated RU) without executing — the safety complement to confirmation/elicitation (#TBD, item M3).

Proposed behavior

• Global --dry-run on mutating commands prints planned effect + RU estimate, performs no writes.

Acceptance criteria

• No mutation occurs.
• Clear plan output.
• Works for create/replace/patch/rm/bulk.
• Docs + tests.

Filed from the Agentic & Automation Roadmap (docs/agentic-roadmap.md), item G1, Wave 1. Priority P1.