feat(setup): explain preview action safety and undo

[mrnicholasbcarter-code]

Summary

• enrich setup-plan actions with reason, security impact, postcondition, and undo
• preserve mutation-free/read-only behavior for existing and missing configs
• add focused contract coverage and document the preview boundary

Closes #110

Validation

• setup and CLI tests: 42 passed
• Ruff: passed
• strict mypy: passed
• pre-commit hook: passed

[github-actions]

📊 Benchmark Results

coding

Metric	Fixed	Verdict	Delta
Success Rate	100.0%	98.0%	-2.0%
Cost/req	$0.014089	$0.006626	53.0%
p95 Latency	146ms	139ms	-7ms

reasoning

Metric	Fixed	Verdict	Delta
Success Rate	98.0%	98.0%	0.0%
Cost/req	$0.007564	$0.004485	40.7%
p95 Latency	144ms	144ms	-0ms

chat

Metric	Fixed	Verdict	Delta
Success Rate	100.0%	98.0%	-2.0%
Cost/req	$0.000098	$0.001424	-1353.1%
p95 Latency	73ms	141ms	68ms