feat: refactor diagram rendering into default plugin, fix broken dev-mode asset resolution

[Copilot]

Diagram rendering was non-functional in dev mode (node src/index.ts) because src/commands/diagram.ts resolved bpmn-js assets relative to src/commands/, pointing at src/assets/bpmn-js/ which only exists after npm run build. This produced blank PNGs silently.

The feature is refactored out of the core CLI into default-plugins/diagram/, structured as a self-contained plugin ready to be extracted into a standalone npm package.

Root cause fixes

• Asset resolution: probes prod path (dist/assets/bpmn-js) first, falls back to dev path (node_modules/bpmn-js/dist) — works in both modes without a build step
• Silent blank PNG: renderer now sets window.__diagramError on failure; Node side checks it before taking a screenshot and throws with an actionable message
• Fragile re-render wait: removed the viewport-resize + bbox-change-detection loop that could hang; simplified to a single zoom-then-screenshot flow

Refactoring

• src/commands/diagram.ts deleted; logic lives in default-plugins/diagram/c8ctl-plugin.js
• Command changes from c8ctl get pi <key> --diagram [--output <path>] → c8ctl diagram <key> [--output <path>]
• src/plugin-loader.ts now exposes globalThis.c8ctl.createClient(profile) so plugins can create authenticated Camunda API clients without importing TypeScript internals
• Plugin ships with package.json + README.md documenting standalone extraction steps

Updated surfaces

• Help text, bash/zsh/fish completions: --diagram flag removed, diagram added as a verb
• Unit tests, integration tests, README, EXAMPLES updated to new command syntax

---

🔒 GitHub Advanced Security automatically protects Copilot coding agent pull requests. You can protect all pull requests by enabling Advanced Security for your repositories. Learn more about Advanced Security.