cli: add external target descriptor verify #705

Summary

Add the first executable external-target protocol surface: wesley target verify <descriptor>. The command validates a target descriptor without running untrusted target code.

Parent context: #680.

Acceptance Criteria

• wesley target verify <descriptor> exists and is listed in CLI help.
• The command validates wesley.target-descriptor/v1 descriptors without executing command.program.
• JSON output reports valid, descriptor identity, and deterministic diagnostics.
• Invalid descriptors fail closed for unsafe command paths, missing required capabilities, denied network or ambient filesystem capability requests, bad protocol versions, and unsafe output paths.
• CLI tests prove valid descriptor acceptance and non-execution of a descriptor command.
• Docs reference target verify as shipped while keeping target run unshipped.

Non-Goals

• No target run command.
• No process execution, sandboxing, artifact copy-out, or SDK template in this slice.
• No product/domain examples.