feat(commandbridge): discover provider commands dynamically

[chicoxyzzy]

Summary

• add an asynchronous, provider-neutral command-discovery lifecycle to commandbridge
• publish discovered inventories as authoritative ACP replacement snapshots, including explicit empty snapshots
• let live-discovery adapters omit a hard-coded startup catalog; existing static-bootstrap conformance remains strict by default
• keep discovery inside the bound provider binary and host-owned environment; discovery callbacks receive no prompts, MCP configuration, headers, or metadata
• provide connection-lifetime cancellation and bounded command-update publication under slow or closed transports

Behavior

A provider discovery result replaces—not merges with or filters—the previous command set. Discovery refreshes after session, configuration, mode, authentication, and successful-prompt changes. Cursor and Grok can continue publishing their native ACP snapshots directly; this creates the shared lifecycle needed by adapters that require a short provider exchange.

Verification

• go test ./...
• go vet ./...
• go test -race ./...
• git diff --check

Review

Two independent review passes covered cancellation, stale updates, blocked-writer behavior, environment/path boundaries, sensitive MCP metadata handling, and the final async-conformance delta. Actionable findings were fixed before this PR.