feat: deliver merchant-facing multi-product Midtrans CLI

[salismidtrans]

Summary

• replace the diagnostic-only CLI experience with merchant-facing status, test, verify, setup, pack, and agent workflows
• add a clean per-project manifest with hybrid routing and typed credential references
• add Sandbox journey support for Snap, Core API, Payment Link, BI-SNAP, GoPay tokenization, and subscriptions/recurring payments
• add resumable operations, evidence aggregation, per-product verification policies, and complete-proof-only verified semantics
• enforce zero production mutation, credential redaction, safe paths, signed request rules, and Sandbox host allowlists
• add a no-sudo local installer, representative merchant fixtures, source provenance, and release gates
• publish the CLI-side Agent Skill compatibility contract; the companion Agent Skill repository change will be reviewed separately

Why

The previous merchant commands could return only low-level results such as PASS: credentials.status, which did not help a merchant or AI agent complete a payment integration. This change turns the CLI into a deterministic execution and verification layer while keeping repository reasoning and code changes in the Midtrans Agent Skill.

Merchant impact

Merchants can install one global binary, initialize or detect configuration per repository, select among Midtrans payment products, execute reviewed Sandbox journeys, resume browser/device interactions, and collect checksummed evidence. Provider acknowledgement is reported as provider_confirmed; the CLI reports verified only when the journey's full compiled proof policy passes.

Safety

• mutations are restricted to approved Midtrans Sandbox hosts
• production mutation is denied before HTTP dispatch
• credentials remain references and are structurally redacted
• operations are persisted with stable IDs and guarded resume/reconciliation behavior
• missing credentials, activation, buyer interaction, or real-device evidence remain explicit blockers

Validation

• ./tools/check_release.sh
  • race-enabled Go suite
  • go vet ./...
  • installer atomicity and rollback tests
  • production-safety and evidence tests
  • build and GoReleaser configuration validation
  • live canonical Midtrans Markdown provenance check
• Agent Skill compatibility E2E test
• local no-sudo installation to ~/.local/bin/midtrans
• hybrid Snap + GoPay smoke test in the Salis Property spike repository; expected real Sandbox prerequisites remained blocked without credentials/evidence