Replace the `isPrivilegeExemptInvocation` argv hack with per-command privilege metadata

## Problem

`cmd/cli/commands/root.go:156` enforces privilege with a single hardcoded gate:
`os.Getuid() != 0` fails the whole CLI unless `isPrivilegeExemptInvocation(os.Args[1:])`
(root.go:286) returns true. That function does raw string matching against `os.Args`
*before* Cobra parses flags, and currently hardcodes exactly two exemptions:
`--version`/`--help`/`version`/`help`, and the specific pair `reconcile-shaper` +
a truthy `--check`. Every future unprivileged command, or command whose privilege
depends on a flag value, requires editing this function by hand and reasoning about
raw argv strings instead of parsed Cobra state.

## Proposed fix

Generalize privilege-checking into command-scoped metadata, mirroring the existing
`SkipGlobalChecks` annotation pattern (`cmd/cli/commands/common/run.go`):

- Default: commands are privileged unless marked otherwise.
- Commands with a static privilege posture set a `cobra.Command.Annotations` key at
registration time.
- Commands whose privilege depends on flag values (e.g. `reconcile-shaper --check`)
implement a small predicate hook evaluated in `PreRunE`, after flags are bound,
instead of matching raw argv.

## Acceptance

- [ ] `isPrivilegeExemptInvocation` argv string-matching is removed.
- [ ] Privilege is checked after Cobra flag parsing, not before.
- [ ] `reconcile-shaper --check` continues to run unprivileged; apply mode continues
to require root.
- [ ] Adding a new unprivileged command, or a new flag-dependent privilege case,
requires only a per-command annotation/hook — not editing a central function.

### Related Issues

Follows from #893.

Read cmd/cli/commands/root.go around the privilege gate and isPrivilegeExemptInvocation, then compare the SkipGlobalChecks annotation pattern in cmd/cli/commands/common/run.go. Trace reconcile-shaper registration and its --check flag; done means privilege is decided after Cobra parsing, --check remains unprivileged, apply mode requires root, and new cases use per-command metadata or hooks.

Written by the indexing model from the issue text.