feat(cli): preview Context authority before access requests

[realmroot]

Outcome

• Add repeatable --scope comparison to the Context list while retaining stable Context IDs and the existing complete permission fields.
• Show the selected Context, selection source, and scope matches before an access request. Include Context metadata in pending and ready JSON results.
• Preserve server JSON errors on stdout with a nonzero exit status. Discovery matches remain informational; the server makes the authorization decision.

Review focus

• The Context list remains unfiltered and keeps its existing ID and permission fields.
• Explicit Context selection still uses stable IDs, with legacy name selection only where the Resource Server does not publish IDs.
• Preflight output must not switch Contexts, synthesize server decisions, or expose credentials.

Verification

• go test ./...
• go vet ./...
• go build ./...
• Read-only Agent acceptance: realmroot toolbox github context --scope metadata:read --scope pull_requests:write --json returned both requested scopes and all four available Contexts with match status; it did not change the selected Context.

Review environment setup: use an enrolled Agent with a connected GitHub Resource Server. The context --scope command above is read-only. The access-request behavior is covered by local tests; it was not triggered against production because it can open a controller approval.

---

_{🤖 Created by Jarvis via Realmroot}