refactor(cli): wire commandRole into dispatch; doc + comment cleanup

Resolve final-review findings: commandRole is now the single source of
truth (Run resolves role once and threads it to handlers, replacing
hardcoded openStore roles). Tighten crypto/SKILL/SPEC/USER-MANUAL wording
and document init's agent-key-on-first-init-only semantics.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

internal/store/keys.go

@@ -37,6 +37,9 @@ func (s *Store) dbPath() string {
 // NOT regenerate the DEK — it unlocks via the admin slot (idempotent re-init).
 func (s *Store) InitKeys(adminKey, agentKey []byte) error {
 	if _, err := s.GetSetting(settingDEKWrapAdmin); err == nil {
+		// Already initialised: the DEK and both wrap slots already exist, so the
+		// agent key is not consumed here. Only the admin key is used to unlock the
+		// existing dek_wrap_admin slot; the DEK itself is preserved unchanged.
 		return s.Unlock(RoleAdmin, adminKey, nil)
 	}
 	dek, err := crypto.NewDEK()