fix(dry-run): gate explicit-ID mutation paths behind resolveDryRun

[gfargo-horizon-agent]

What

Every mutating command's explicit-ID path now routes through the shared resolveDryRun(parentOpts, default) helper, so a global --dry-run can no longer reach a live WordPress or SQLite mutation.

Why

Closes #190
Plane: OSS-928

--dry-run was silently ignored on several commands' explicit-ID paths — optimize 123 --dry-run, convert, resize, remove-bg, regenerate 123 --dry-run, undo --snapshot 17 --dry-run, and posts create --dry-run all executed live mutations despite the flag. rename --dry-run also wrote a local SQLite row before its dry-run guard. The existing honesty test only grepped for loose substrings (dryRun, parentOpts.apply), which any bulk-only or unrelated reference could satisfy, so it passed 13/13 while these gaps existed.

How

• optimize.ts, undo.ts: replaced ad hoc isBulk && !parentOpts.apply checks with resolveDryRun(parentOpts, isBulk).
• convert.ts, resize.ts, remove-bg.ts: added a dry-run gate (none existed before) ahead of the sharp preload / rembg check, so a preview doesn't even prompt to install native deps.
• regenerate.ts: unified the previously --all-only dry-run check into one gate covering explicit IDs too; the --all id-listing (read-only) still runs first.
• posts.ts: added the missing dry-run gate to posts create (update/delete already had it).
• rename.ts: moved the db.upsertAttachment call inside the existing if (!dryRun) guard so a dry-run no longer writes a local row.
• vision.ts, import.ts: routed through resolveDryRun instead of checking parentOpts.apply / parentOpts.dryRun directly — same defect class (an explicit --dry-run was silently ignored when combined with other flags).
• dry-run-honesty.test.ts: now requires the literal resolveDryRun( call (no more loose substring matching) and covers convert/resize/remove-bg/references in addition to the existing commands.
• Added dry-run-honesty-behavior.test.ts: behavioral tests that actually invoke posts create --dry-run (asserts fetch is never called) and rename --dry-run (asserts no SQLite row is written).

Testing

• build passes
• tests pass / added (bun test test/unit/ — 622 pass, 0 fail)
• lint clean (bun run lint)
• typecheck clean (bun run typecheck)
• CI: pending

Closes #190

[gfargo-horizon-agent]

🔎 Agent review (sonnet) — LGTM

REVIEW: LGTM
RESOLVES: full

Every gap listed in OSS-928 (optimize, convert, resize, remove-bg, regenerate, undo, posts create, rename) is now routed through resolveDryRun exactly as the plan specified, with the honesty test tightened to require the literal call and new behavioral tests for the two highest-risk cases (posts create, rename). Typecheck, lint, and the full unit suite (622 pass) all succeed, and the diff stays tightly scoped to the defect class with no unrelated changes.