cli: wire egress-velocity thresholds through the drift gate (closes #457)

[Maqbool61]

Problem

apply_egress_velocity_change (added in #446) had no caller. A user could
hand-edit .doberman/policies.yaml to loosen burst, volume-bytes, or
fanout without ever crossing the possession-factor gate — silently bypassing
the raise-only invariant the gate exists to enforce.

Closes #457

Solution

Add doberman egress-velocity to the CLI, mirroring doberman prefs exactly:
gate first, save only on outcome.approved. Every loosening now has to
cross the same TOTP-or-password weaken path as every other policy weakening.
Hand-editing the YAML still works mechanically, but the sanctioned path is
the CLI, and operators who care about the audit trail will use it.

What the command does

doberman egress-velocity # show current thresholds + built-in defaults
doberman egress-velocity burst 10 # tighten (frictionless, no prompt)
doberman egress-velocity burst 30 # loosen (TOTP if enrolled, else password)
doberman egress-velocity volume-bytes 10485760 # same gate for volume
doberman egress-velocity fanout 5 # same gate for fanout

Tightening (lower value than currently stored) → method=auto, prompter
never invoked, recorded in ledger, persisted immediately.

Loosening (higher value than currently stored) → confirmation prompt, then
TOTP if enrolled, else password. Denied on wrong factor, declined confirm, or
no factor enrolled. Denial recorded in ledger; nothing written to disk.

Shape mirrors doberman prefs

• Same load_policy → gate → save_policy skeleton
• Same outcome.approved guard before any write
• Same ledger recording for every attempt (approved or denied)
• Inserted immediately after prefs in the Policy panel

Files changed

File	What
src/doberman/cli/main.py	New egress-velocity command + apply_egress_velocity_change / VelocityThresholds imports
tests/unit/test_cli_egress_velocity.py	17 new tests mirroring test_cli_lowering_gate.py
tests/unit/test_cli_help.py	("egress-velocity",) added to CLI_HELP_TARGETS

Test coverage

• Show path: no-policy (built-in defaults) and saved-policy (custom values)
• All three knobs tighten without touching the prompter (_Boom guard)
• Loosening gates through 2FA, password-only, wrong password, declined confirm, no factor enrolled
• Every denial is recorded in the append-only ledger with approved=0
• Owner's key scenario: after a gate-approved loosening to burst=25,
  moving to burst=22 is a strengthen relative to the current stored value —
  frictionless, no gate, method=auto — even though 22 > 20 (built-in default)
• Bad knob, missing value, zero, and negative all exit code 2 with nothing persisted

Checklist

• ruff check — 0 errors
• ruff format --check — 383 files already formatted
• lint-imports — 3 contracts kept, 0 broken
• python scripts/check_markdown_links.py — no broken links
• 3156 passed, 0 failed, 91.82% coverage (above 80% threshold)

[Maqbool61]

The secret-scan failure is unrelated to this PR. Gitleaks recently required a paid license key for organizations — the error is:

[DobermanCore] is an organization. License key is required.
Error: missing gitleaks license.

This fails in 7 seconds before scanning any code, and would affect every PR opened against this repo. All 5 test jobs (Ubuntu 3.11/3.12/3.13, Windows 3.12, package-smoke-test) pass. The PR is ready to merge.