CLI for policy management

[Alhaji-naira]

Summary

Add a small agentguard CLI (packages/cli) wrapping the SDK: create, update, revoke, usage, preview. Reads keys from env/keystore, never from args.

Acceptance criteria

• Commands work against Testnet
• --help documented for each command
• A smoke test