feat(autofix): add incident repair mode for CLI command-level fixes

[jackwener]

Summary

• Add incident repair mode to AutoFix (fix.ts --mode incident --spec <name>) for detecting and fixing CLI command failures caused by site changes
• New eval-cli.ts runner with failure taxonomy (regression / precondition / infrastructure / skipped) — metric only counts regressions
• New command-specs.json with 3 initial specs: weibo-hot-smoke (read_only), xiaohongshu-search-smoke (read_only), twitter-reply-fill-smoke (fill_only)
• Safety profile: read_only / fill_only / publish classification per spec, fill_only injects OPENCLI_DRY_RUN=1
• Twitter reply now supports OPENCLI_DRY_RUN — fills composer without clicking submit, returns { status: "dry_run", filled: true, submitted: false }
• Full design doc at designs/autofix-incident-repair.md

Closes discussion from #855 review thread about AutoFix not being able to detect CLI command-level failures.

Design

See designs/autofix-incident-repair.md for the full design document, co-authored with @codex-mini0.

Key decisions:

• Two modes, one entry point: fix.ts handles both repo repair (existing) and incident repair (new) via --mode flag
• Incident mode guard is stricter: npm run build && npm test (must not break repo health)
• Failure taxonomy: prevents engine from trying to "fix" auth issues or infra problems
• Safety enforcement: publish specs require explicit --allow-side-effects
• OPENCLI_DRY_RUN is internal-only — not a public CLI flag yet

Test plan

• Build passes (npm run build)
• Twitter reply unit tests pass (7/7)
• @codex-mini0 design review against agreed Phase 1 constraints
• Manual: npx tsx autoresearch/eval-cli.ts runs all 3 specs
• Manual: npx tsx autoresearch/eval-cli.ts --spec weibo-hot-smoke runs single spec