[josegonzalez]

sdk.Diagnostics turns a plan result, a task's output state or a read error into masked error and warning entries, each with a stable reason, a short summary and a detail carrying the command's output, so an embedder no longer masks each field or formats each error type itself. The CLI's plan and apply output, human and JSON, now render every task error and warning through the same helper, and print exactly what they printed before. WarnReasonServiceOptionDrift is now exported to the sdk.

There is no visible change to CLI output: the plan and apply lines, the apply continuation lines, and the JSON error, stdout, stderr, exit_code, reason and message fields are byte-identical, and a new test pins that for a failed command, an ssh failure, a version refusal, a missing app, an unreadable state and a generic error. The JSON event schema is unchanged.

Decisions: WarnReasonServiceOptionDrift is exported because a warning diagnostic carries its reason as the key to branch on, and an embedder needs every key it can receive. SSHError stays unaliased: the ssh diagnostic reason gives an embedder the transport-failure branch without the type, and the type's fields hold unmasked text that Diagnostics exists to keep out of view. A transport failure is classified before a version error, so a version that could not be read because ssh failed reports as an ssh failure, which matches the CLI's long-standing ssh: label. Diagnostics masks every string it returns, summaries included, since it cannot tell server text from recipe values; the CLI's own --app and path arguments never pass through it. Errors come before warnings in the returned list, and an unsupported input type returns a single error diagnostic naming it rather than nothing.

Closes #647