fix(cli): color only DENY Decision on test/explain

[christopherkarani]

Summary

• Color only the DENY Decision word on ryk test and default ryk explain when the TTY has colour.
• ALLOW stays plain. Why / Rule / Safer / Next stay uncolored.
• JSON, NO_COLOR, --no-rich / RYK_NO_RICH, TERM=dumb, and pipes stay plain.
• ryk test left always_machine so theme can paint on a colour TTY; banner stays off via shouldShowBanner. Does not implement [UX] drop the shield banner from almost every command #215.

Fixes #216

Test Plan

• ./scripts/zig build
• ./scripts/zig build test -Dtest-filter="writePretty" (includes color DENY / plain ALLOW)
• ./scripts/zig build test -Dtest-filter="shell_test" (color DENY, plain ALLOW, JSON no CSI)
• existing glanceable receipt + test rm -rf tests
• piped ryk test "rm -rf /" is plain Decision: DENY (exit 2)

Presentation only. No policy / fail-closed / grade change.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[christopherkarani]

REVIEW_PACKET pr=507 verdict=APPROVE findings=0

Cannot GitHub-approve (same-account author). Factory stamps applied: review:approve + test:pass.

Presentation-only. No policy / fail-closed / grade / ask-wire change.

• DENY Decision word only via theme.paint. ALLOW plain.
• ryk test left always_machine so theme can paint; banner stays off.
• JSON / NO_COLOR / --no-rich / pipes stay plain.
• Local: build + writePretty + shell_test + leftover-ask + piped/JSON smoke all exit 0.
• CI zig-fast pass. One zig-full flake on leftover-ask (local rerun pass). Merge waits for CLEAN.

REVIEW_PACKET pr=507 verdict=APPROVE findings=0