fix(check): fail when the server withholds runtime rules for entitlement

[thecodedrift]

Under every CLI through 0.11.2, a runtime rule the server withholds because the organization's plan lacks runtime signatures is skipped with a generic "unsafe / unknown / drift" notice, and check exits 0. A customer whose paid plan lapses gets a green taskless check while their runtime rules have stopped running.

What changes

• check exits 1 when reconcile's entitlement.withheld is non-empty, in human and --json modes. Each withheld rule is skipped with not included in your Taskless plan (never "drift"), one notice names the rules, reason, and upgrade URL (printed once), and --json gains an optional entitlement object. A withheld file matching no local rule still fails the run, named by its path; a withheld file is never sent to restore.
• Restore under a lapsed plan still writes the blessed bytes but stops promising the next check blesses them.
• rule create / rule improve warn in notices when they write a runtime rule the plan will not run. Static rules never warn.
• check and ci agent recipes (topics v3 / v2) document the exit and tell an agent not to reach for --anonymous or --dangerously-run-scripts to get green.

Unauthenticated, --anonymous, degrade paths, and sg/vale rules are unchanged. A response with no entitlement, or runtimeSignatures: true, is behavior-identical to today (tested).

Review notes

• Ships ahead of the server. taskless/taskless#207 is not deployed; the live __schema has no entitlement (measured 2026-09-27). Restore and retrieval type it as MayCarryEntitlement<T>, an optional unknown normalized by parseEntitlement. Tightening once it is always sent is Tighten entitlement and file-set signature typing once the service always returns them #409.
• The vendored schema is deliberately not regenerated. The live schema has dropped signature from the sg/vale file-set variants (runtime keeps it) pending a cloud change, and also carries an unrelated successCases shape change. Both in Tighten entitlement and file-set signature typing once the service always returns them #409.
• cli-check's exit-code requirement is MODIFIED under its unchanged title and restates all three standing scenarios. Before/after title sets across the three touched specs: 0 lost, 19 gained.
• The change is archived on this PR (single-PR delivery).
• Follow-up: gating --dangerously-run-scripts on a TTY or CI=1 is Require a TTY or CI=1 for --dangerously-run-scripts #408.

Fixes #403