[feature] Dry-Run Support

[Kukkerem]

Goal

Add a --dry-run global flag that validates a command invocation fully (resolving all
parameters and running input validators) without executing the business logic or touching
any external system.

Motivation

For read-only operations like export, a bad parameter means a bad result.

Dry-run lets agents build a call, fully validate it, and confirm the resolved parameters with the user before committing.

Task

A --dry-run boolean flag needs to be added to the root command so that it is available to
all subcommands automatically, with no per-subcommand implementation required.

In dry-run mode, all parameters should be resolved, and all validators should run, but the
actual business logic (GetRun) should not be called. The resolved parameter set should be
printed as JSON to stdout, with sensitive values redacted, and the process should exit
cleanly.

Dry-run state should be accessible in the context so that subcommand authors can implement
custom dry-run behavior if needed (e.g., for commands where parameter validation alone is not
sufficient).

Acceptance criteria

• --dry-run is available as a global flag on all subcommands
• All parameter resolution and validation runs in dry-run mode
• Business logic is not called in dry-run mode
• Resolved params are printed as JSON to stdout
• Sensitive param values are redacted in the output
• Dry-run state is accessible in the context for custom subcommand behavior
• Tests verify: validation runs, business logic does not, sensitive values redacted

[gergely-szabo-sap]

Are authentication/authorization operations performed during dry-run?

[Kukkerem]

It's mostly about input validation and ensuring the agents are using at least sane parameters. I don't see the need for auth here. Maybe for some kind of client-side/server-side validation, as kubectl does?

[gergely-szabo-sap]

I have no strong opinion about this one. Agentic auth-check can be abused to perform brute-force authentication attempts. Maybe. 🤷

[Kukkerem]

As I see it now, it's not necessary at all. Let's keep it simple, and expand when we see any value in it.