feat(backend): manage default CLI passport scopes

[yhzhang35]

Problem

Default CLI authorization was not managed by engine-specific configuration. Bootstrap and later Passport overwrite writers could not safely reconcile YAML-required CLI entries, preserve historical CLI identity modes, and expose CLI caller/owner settings with the existing Bot-level caller aggregate.

Solution

• Add a strict YAML capability manifest for openclaw and claude_code/generalCC, with dataphin and deepinsight-cli as managed Default CLI entries.
• Reconcile the complete AgentPass MCP and CLI scope during device bootstrap; preserve historical CLI items and identity modes, including the existing nine generalCC creation-time CLI entries.
• Add sparse CLI caller configuration, caller-context projection, Bot aggregate integration, OpenAPI mutation endpoints, migration, and focused diagnostics.
• Preserve full CLI scope in existing MCP synchronization and runtime projection writers.

Validation

• 374 passed in the focused Backend suite after rebase.
• Ruff, bytecode compilation, and Git whitespace checks passed.
• Rebased without conflicts on origin/dev at 14e6b4ed709053a1fe3489a0217231cef75aad59.

Compatibility and risk

• CLI caller/owner is an AgentPass authorization configuration. Runtime engine consumption of CLI identity_mode still requires container E2E validation.
• No DaaS code is included in this Avernet-only PR.

Spec

• src/backend/specs/cli-default-install-identity/