cloudsec remediation: fail cleanly on a run without a reviewable generation

[maximelb]

Follow-up to the remediation commands.

• If a run's generation is missing or is not a non-negative integer, approve, reject and cancel now stop with a clear message instead of a TypeError traceback. Approving also requires a target digest. Nothing is sent in either case.
• The refusal message now says "approved", "rejected" and "cancelled" instead of "approved", "rejectd" and "canceld".
• doc/cli/cloud-security.md now states that the confirmation token is a review step, not a secret. The server is the gate: it requires cloudsec.respond and refuses a stale generation or target digest.

Tests: test_a_run_without_a_reviewable_generation_fails_cleanly covers a None, string, negative and bool generation, both with and without a token. test_the_refusal_names_the_decision_correctly covers the wording. Both fail on the previous code (6 failures). The full suite passes: 4564 passed, 6 skipped.

🤖 Generated with Claude Code

[maximelb]

Self-review of the head commit, taken from a pristine archive. The automated reviewer does not run on this repository.

• The generation check runs before the token is derived. A bad generation therefore stops both the review call and the confirmed call, and nothing is sent in either case.
• An approve without a target digest is also refused locally.
• The refusal wording comes from a fixed map.
• The docs change is accurate. The server's permission check and generation/digest fence are the gate.
• The diff and this PR contain no private names.

No open issues.