Feat/security commands

[cxy01313369]

What

Adds two read-only Agent Security Center (AgentStudio) commands:

• bl security overview — protection overview (last 24h): capabilities, protection toggles (+ asset counts), detection cards (content safety / file scan / skill scan).
• bl security alerts — alert list with risk-level / asset-type / status / vendor / pagination / sorting filters.

Why

Brings the Agent security posture to the terminal and AI agents, alongside the existing knowledge / managed-agent AgentStudio command families.

How it fits the repo

• Host: reuses the per-workspace AgentStudio scheme (agentStudioHost, same shape as ragEndpoint). Derived from --workspace-id, or overridden when --base-url / auth login --base-url points at a non-DashScope origin — mirrors the managed-agent login flow. Absolute URL + Client Bearer injection, so the model-domain base_url never leaks in.
• Envelope: parseSecurityBody tolerates the shapes the backend serves today — bare payload (REST), legacy {success,data}, and the console-gateway Zelda DataV2 double-envelope; detection cards accept snake_case and camelCase. 12000092 → AUTH; unrecognized shapes surface a truncated body for diagnosis.
• Conventions: auth:"apiKey"; shared text/json/--quiet/--dry-run contract; enum flags via choices (fast-fail, exit 2, zero requests); reuses resolveWorkspaceId; bilingual en-US/zh-CN help; no single-letter identifiers.

Files

• core: client/security.ts, client/endpoints.ts, types/security.ts
• commands: commands/security/{overview,alerts,shared}.ts + registration (commands/src/index.ts, cli/src/commands.ts)
• tests: core/tests/security-envelope.test.ts, commands/tests/e2e/security.e2e.test.ts (+ topic-routes.ts)
• skills: regenerated bailian-cli reference for the new security group

Testing

• pnpm check clean. Unit security-envelope.test.ts: 7 passed. E2E security.e2e.test.ts: 10 passed / 2 skipped (live-gated).
• Verified live on pre-release (trial.cn-beijing.pre-maas.aliyuncs.com): overview renders banner / toggles (with counts) / detection cards; alerts returns stats + list.