Add c1i roles list and roles get

[leet-c1]

Summary

Adds c1i roles list and c1i roles get, split out of #143 to keep that PR focused on login.

• roles list paginates GET /api/v1/iam/roles as NDJSON rows: id, name (e.g. system:viewer), display_name, system_builtin, system_api_only, created_at, updated_at. Bools are real bools, and unset timestamps are null.
• roles get <role-id> prints one role, including its serviceRoles and permissions.

These are where the ids that service-principals credentials create --scoped-role takes come from. Before this, only c1i api --path /api/v1/iam/roles reached them.

Documented in README (Roles), cmd/agents.md (Choosing a command), and CHANGELOG.

Test plan

• go vet, golangci-lint (0 issues), gosec, go test -shuffle=on
• Pagination case in listPaginationCases, unwrap case in getUnwrapCases, and a roleRow type test (mutation-checked)
• The docs guards (TestEveryFlagIsDocumented, TestAgentsMDCommandsResolveAgainstCobraTree, TestReadmeCommandsResolveAgainstCobraTree) pass
• Live on the lab tenant:
  • roles list returned every role, with real-bool fields.
  • roles get returned Basic User with 196 service roles and 10 permissions.
  • A malformed id exits 2 with the server's ^[a-zA-Z0-9]{27}$ error.

🤖 Generated with Claude Code