Approval gate and structured preview renderer for T2/T3 CLI actions. Handles `--yes`, T3 `--confirm`, JSON/non-TTY refusal, and machine-readable AppError failures.
pnpm dlx shadcn@latest add "https://cligentic.railly.dev/r/trust-ladder.json"