feat(cli): add symbols/refs/cfg/callgraph/cost query commands

[e54-bot]

Summary

Implements #429: the semantic query surface previously reachable only through wright serve / wright-agent/v1 is now exposed to humans, nested under inspect per #439's top-level-surface principle ("#429 owns the inspect query surface").

• CLI: wright inspect keeps the bounded summary; its subcommands expose the detail areas — inspect symbols [INPUT] [--only KIND], inspect refs <NAME> [INPUT], inspect cfg <RULE> [INPUT], inspect callgraph [INPUT], inspect cost [INPUT]. Each runs its agent operation (symbols, references + usage, cfg, callGraph, costEstimate) through the session's ToolService, so CLI result payloads equal the agent payloads by construction. refs reports the usage counts as the header of the reference list; cost honors the shared finding-selection options. Mixing an [INPUT] positional with a query subcommand is a usage error.
• Naming: the issue's --kind symbol-kind filter collides with the existing --kind input-frontend flag, so the filter is spelled --only (inspect symbols --only rule), per maintainer direction on the simpler name.
• Agent contract: references.symbol, usage.symbol, and cfg.rule accept a numeric id or the declared name (untagged Address; schema integer|string). Names resolve through the analyzer's SemanticIndex inside the driver — callers never learn the program's numbering, where symbol ids and rule indexes are different spaces. Unknown/ambiguous names return structured unknown-symbol / ambiguous-symbol / unknown-rule / ambiguous-rule errors listing candidate ids; resolution never guesses. usage additively echoes the resolved id/kind.
• analyze: result.facts.persistentObjects carries the same facts persistentObjects serves (with resolved span paths); the text overview reports the count.
• inspect summary: text output names the nested detail command for each area.
• References keep the existing reference-model locations until Report reference and declaration spans at the identifier, from workshop-rs provenance #433 lands; no test asserts identifier-exact spans.

Test plan

• cargo fmt --all -- --check
• cargo clippy --workspace --all-targets --all-features -- -D warnings
• cargo test --workspace --all-targets --all-features </dev/null — all 31 test targets pass
• git diff --check
• Analyzer: name resolution finds unique symbols/rules; unknown/ambiguous produce the structured codes and candidate lists
• Driver: name vs numeric addressing returns identical payloads; session query workflows equal the agent op payloads; analyze reports facts.persistentObjects
• CLI black-box: all five query subcommands in text and JSON, --only filter, usage header counts, callgraph edge, exact cost counts + selection, unknown/ambiguous diagnostics, bare-inspect detail-command pointers, top-level/inspect --help coverage
• Schema: wright-agent/v1 validates integer and string address spellings, rejects other types; UsageResult/AnalyzeResult validated against live responses
• Real fixture: overpy-cake.ws — cakePos 16 reads / 1 write / 17 references, cfg 18 blocks, cost 3960 bytes / 29 actions / 2 rules / 1 wait

Generated with Devin