refactor: unify env + JSON helpers; secure key perms; CA verify; inspect timeout; RunE

Summary

• Improves security, reliability, and maintainability with minimal behavior change.
• Centralizes env and JSON logic, adds inspect timeouts, completes CA verification, and normalizes Cobra error flow.

Changes

• Env helpers: new internal/environ (IsCI, SupportsUnicode); used by UI and cmd.
• JSON helpers: printJSON, printJSONError standardized across commands.
• Key perms: generated private keys now 0600 on Unix (Generate).
• CA verification: Verify validates chain when --ca is provided (PEM or DER) via x509.VerifyOptions.
• Inspect timeouts: default 5s dial timeout; new --timeout flag on inspect.
• Cobra: commands use RunE and return errors (consistent non-zero exit on failure).
• SAN parsing: DRY via pkg/cert/san.go (supports DNS, IP, email, URI).
• Root help: rely on Cobra defaults; --version still prints version.
• Docs: updated docs/commands.md, docs/usage.md, docs/faq.md; added AGENTS.md.

Why

• Security: consistent least-privilege for private keys.
• Consistency: single source for CI/unicode and JSON output.
• UX: avoid hangs with timeouts; complete verification with CA chains.
• Maintainability: reduce duplication; clearer error flow and tests.

Validation

• Build: make build succeeds.
• Tests: make test passes (all packages).

Backward Compatibility

• No flag/command renames. verify still exits non-zero on failure (now via returned error).

Follow-ups (optional)

• Add CERT_TIMEOUT env default for inspect.
• Tests for CA verification with a fixture chain.
• Consider shared output abstraction if more formats are added.