refactor(cli): wire commandRole into dispatch; doc + comment cleanup

Resolve final-review findings: commandRole is now the single source of
truth (Run resolves role once and threads it to handlers, replacing
hardcoded openStore roles). Tighten crypto/SKILL/SPEC/USER-MANUAL wording
and document init's agent-key-on-first-init-only semantics.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

specifications/SPEC.md

@@ -73,8 +73,9 @@ the DEK-wrapping scheme:
   commands (`list`, `get`, `search`, `ack`, `send`, `doctor`) only. `EMCLI_ADMIN_KEY` is a superset:
   a process with only the admin key can also run agent commands.
 - Agent commands use `EMCLI_KEY`; if only `EMCLI_ADMIN_KEY` is set, they fall back to it.
-  If neither key satisfies the required slot, `emcli` exits with:
+  If a process holding only `EMCLI_KEY` attempts an admin command, `emcli` exits with:
   `emcli: this command requires EMCLI_ADMIN_KEY (admin privilege)`.
+  (An agent command with no key set at all yields a different `config` error: `EMCLI_KEY is not set`.)
 - `EMCLI_KEY` is supplied by the orchestrator that launches `emcli`, never as an argument the agent
   constructs. The agent has no command that reveals secret values.
 - All policy decisions happen inside `emcli`; the agent cannot bypass them because it has no other