feat: demonstrate lifecycle safety contracts - #12

Summary

• Add a local reconciliation state write that is skipped in dry-run mode.
• Exercise managed temporary input and consumer cleanup hooks.
• Document human/machine output, structured errors, debug logs, and sensitive-argument redaction.

Validation

• ./tests/validate.sh
• UV_CACHE_DIR=/private/tmp/base-cli-demo-issue4-uv uv run --extra dev pytest -q (9 passed)
• UV_CACHE_DIR=/private/tmp/base-cli-demo-issue4-uv uv run --with ruff ruff check src tests
• UV_CACHE_DIR=/private/tmp/base-cli-demo-issue4-uv uv run --with ruff ruff format --check src tests
• git diff --check

Fixes #4