cli: add agentmetry disposition for detection triage

[blitzcrieg1]

Problem

The four-week dogfood gate turns red when any critical or high detection in a week is still untriaged at week close. Dispositioning is the one operator action that closes that gap.

Every other gate operation has a CLI command:

• agentmetry dogfood
• agentmetry stats --days 7
• agentmetry verify --trail
• agentmetry doctor

Disposition does not. The only paths today are:

1. Dashboard UI
2. POST /api/v1/audit/detections/disposition with an API key

That gap bit us on 2026-08-23: week 3 had one high (session-tool-burst, correlation 94b81615-42b1-408e-ae07-2f50ccab12b6) that could only be closed via a raw API call. A pilot operator on Win11 with hooks installed but no dashboard habit would hit the same wall.

Proposal

Add a thin CLI client over the existing endpoint:

agentmetry disposition <correlation_id> <rule_id> \
  --status resolved|false_positive|risk_accepted \
  --note ... \
  [--decided-by home-lab]

Valid closing statuses match the API: resolved, false_positive, risk_accepted. Require --note for false_positive and risk_accepted (same rule as disposition.py).

Implementation sketch:

• New subcommand in agentmetry/cli/__init__.py
• POST to /api/v1/audit/detections/disposition using AGENTMETRY_URL and optional AGENTMETRY_API_KEY
• Print the returned disposition JSON (or a one-line summary)
• Exit non-zero on HTTP 400/500 with the server detail

No new server logic. The trail write and index update stay in apply_disposition().

Docs to fix when this lands

• trail-debug skill currently says disposition is available via CLI; it is not yet.
• README gate checklist should list agentmetry disposition beside dashboard triage.

Acceptance

• Operator can close a finding from a shell on a machine where the orchestrator is running, without opening the dashboard.
• agentmetry dogfood week with a dispositioned high stays green.

[blitzcrieg1]

Shipped in #139 by @hossainzarif23, merged as 5f120f0.

agentmetry detections <correlation_id> prints the detections for a session, with a non-zero exit when the orchestrator is down.

It also does one thing this issue did not ask for and should have. An empty result no longer looks the same as a disabled recorder: when audit export is off the command says so and names the variable to set, instead of reporting "no detections" for a session that was never recorded.

Reviewing that second commit turned up the same message in agentmetry stats naming a variable that does not exist, fixed in #160. Thank you, and the near-miss was worth more than the feature.

[blitzcrieg1]

Reopening. My previous comment was wrong: #139 shipped agentmetry detections, which is #8, not the disposition command this issue asks for.

This issue is about dispositioning detections so the dogfood gate can close, and the only PR that implemented it was #140, which was closed unmerged. It is still open work.

Apologies for the noise.