feat(cmd): add --dry-run to update, create, and fix

[willkg]

Adds --dry-run to update, create, and fix: preview what a run would do without writing to Confluence or to any file.

Closes #11.

Behavior

• Per-file human output is identical to a real run, distinguished only by a leading DRY RUN banner and a dry_run: true field in --json.
• Validation is unchanged, so a dry-run exits non-zero on the same failures a real run would.
• update's mtime skip and --force are honored, so the forecast matches what a real run would actually do.
• Previewed actions cover pages, attachment uploads, page-width changes, and — for create — frontmatter write-backs.

Attachments

Attachment sync is split into a plan phase and an execute phase:

• planAttachments decides created/updated/skipped per file, reading the page's existing attachments and each local checksum.
• PlanAttachments reports that plan for --dry-run.
• SyncAttachments executes it.

Both paths consume the same plan, so they cannot disagree about what an upload would do.

Create previews

A create dry-run creates nothing, so a previewed page has no id or URL, and an in-set child's parent is unresolved. The parent's source .md is reported in the parent_file output field, which is now present in every run.

Notes

• schema/json-output/v1.json is updated for the new dry_run and parent_file fields, so TestSchemaConformance stays green.
• Design notes in _plans/016_dry-run.md.
• make test && make lint && make vet pass.