cli: add review workflow plan command

[Prachi194agrawal]

Summary

Adds a new read-only security-triage review plan command that prints the local dry-run and human-gated review/apply workflow for the Flatcar security triage assistant.

This supports flatcar/Flatcar#2200 by making the AI-assisted security triage flow easier for contributors and maintainers to inspect before any GitHub or model calls are made.

What changed

• Added security-triage review plan
• Prints discovery, cleanup, review render, review create, and review apply commands
• Requires explicit advisory/review repositories
• Supports optional Markdown file output
• Added CLI tests
• Documented the command in README.md

Testing

python -m pytest tests/test_cli.py --no-cov
python -m pytest --no-cov
ruff format --check src/ tests/
ruff check src/ tests/
mypy src/ tests/

[Copilot]

Pull request overview

Adds a new read-only security-triage review plan CLI subcommand that prints the local dry-run + human-gated review/apply workflow (optionally to a Markdown file), making it easier to inspect the intended workflow before running any actions.

Changes:

• Introduces security-triage review plan and wires it into the CLI dispatch and argument parser.
• Adds a Markdown renderer that prints a curated end-to-end command sequence (discovery/cleanup → review render/create → review apply).
• Adds CLI tests and documents the new command in README.md.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated no comments.

File	Description
tests/test_cli.py	Adds tests for review plan registration, required repo enforcement, stdout output, and file output behavior.
src/security_triage/reporting.py	Adds render_review_plan_markdown() to generate the plan Markdown content.
src/security_triage/cli.py	Adds the review plan subcommand, parser args, and run_review_plan_command() implementation.
README.md	Documents how to print the workflow plan via security-triage review plan.

[danielszot]

How this one differs from security-triage review render we already have?

[LexiNadolski]

How this one differs from security-triage review render we already have?

@Prachi194agrawal just following up on Daniel's comment. Can you answer so we can figure out if we should close this out or not.

[Prachi194agrawal]

Thanks @danielszot , @LexiNadolski for the follow-up.

security-triage review render and this proposed review plan are meant for different points in the workflow:

• review render is an actual dry-run renderer. It consumes discovery/cleanup JSON, builds the exact review issue body, includes the embedded manifest, and writes the same Markdown that review create would submit.
• review plan is only a static/no-input workflow guide. It does not consume reports, build manifests, or render review issue bodies. It just prints the recommended command sequence and safety model for running discovery/cleanup → review render/create → review apply.

So the intent was to help new contributors/operators understand the human-gated workflow before they have generated any reports.

That said, I understand the concern that this may be too much extra CLI surface if the same guidance is better kept in the README. If you think review render plus documentation is enough, I’m happy to either narrow this PR to README-only docs or close it.

[danielszot]

I wouldn't add a code that is not necessary, let's keep it simple wherever we can.