fix(safety): enforce --strict in build-safe.sh

Ensures YAML typos in safety profiles cause build failures instead of
silent warnings. Without --strict, a mistyped key like 'gmal' instead
of 'gmail' would silently exclude the service (fail-closed is safe but
violates user intent). All three preset profiles already pass --strict
with zero warnings.

…profiles

New upstream commands:
- gmail: archive, mark-read, unread, trash (convenience organize commands)
- sheets: links/hyperlinks (read cell hyperlinks)

Profile decisions:
- full: all enabled
- readonly: mark-read/unread enabled, archive/trash disabled
- agent-safe: archive/mark-read/unread enabled, trash disabled
- example: archive/mark-read/unread enabled, trash disabled

fix(safety): readonly profile - mark-read and unread are write ops

Both commands modify message state via Gmail API (add/remove UNREAD label).
Setting them true violated the readonly profile's stated contract of
no writes. All four gmail organize commands now correctly disabled:
archive, mark-read, unread, trash all false in readonly.

fix(safety): harden gen-safety and build-safe.sh robustness

- build-safe.sh: anchor to repo root via cd $(dirname $0) so relative
  paths work correctly when script is invoked from outside repo root

- discover.go: buildSpecsForStruct now fatal() instead of warn() when
  a struct is not found; warn() was semantically wrong since missing
  struct guarantees a compile failure anyway - better to fail loud early

- main.go: fatal on empty/null YAML profile instead of silently
  disabling all services with no warnings (empty profile now gives
  clear actionable error message)

- main.go: generateCLIFile now skips services where all leaf commands
  are false, matching the stated comment and preventing ghost empty
  top-level commands in the CLI struct

- Remove cmd/extract-types/ (one-time migration artifact, not ongoing tooling)
- Add docs/safety-profiles.md explaining the *_types.go convention,
  YAML format, build process, and contributor workflow
- Unify utility-command exception lists: buildKnownKeys now derives
  tolerated YAML keys from utilityTypes via buildCLIFields, removing
  the manually maintained config/time hardcoded entries
- Add TestEndToEndSafeBuild: generates from full.yaml with --strict
  then compiles with -tags safety_profile
- Add TestValidateYAMLKeys, TestBuildEmptyStruct,
  TestBuildEmptyStructWithNonCmdPrefix

--verify detects two classes of drift: DUPLICATE structs (in both
types and source files) and MISSING services (new CLI-level types
without a corresponding *_types.go). Intended for CI pipelines.

--sync generates *_types.go files for new services found in source,
skipping files that already exist.

Together they give maintainers a clear workflow after merging upstream:
verify to see what needs attention, sync for new services, then
manually remove duplicates guided by the verify output.

Rebase safety profiles onto latest upstream/main (168 new commits).
Update all types files and YAML profiles to match current upstream
command set.

Changes:
- Add admin_types.go for new Admin Directory service
- Add ~30 new command keys to all YAML profiles (gmail autoreply,
  calendar subscribe/alias, chat reactions, forms questions/watch,
  keep create/delete, sheets merge/freeze/tabs/named-ranges,
  slides create-from-template)
- Pre-validate warnings before writing files (--strict aborts early,
  no stale generated files left on disk)
- Deduplicate warnings and add service path context to messages
- Fatal on unexpected YAML types in isServiceDisabled (was warn)
- Add EXIT trap to build-safe.sh (covers ERR + SIGINT/SIGTERM)
- Add tests: disabled command exclusion from output, CLI alias
  filtering, warning deduplication, agent-safe.yaml in E2E build
- E2E test cleanup with t.Cleanup to avoid source tree side effects
- Fix orphaned doc comments, remove redundant Makefile target
- Fix docs: utility command description, merge workflow advice
- Fix gofmt violations

Enable low-risk commands that are recoverable via version history
or inherently non-destructive:
- gmail labels rename (helps with triage organization)
- chat messages react (adding emoji reactions is harmless)
- forms move-question (reordering, non-destructive)
- sheets add-tab, rename-tab, delete-tab (version history)
- keep create (creating notes is low risk)

Scans all YAML profiles for missing command keys and adds them with
profile-appropriate defaults (true for full.yaml, false for others).
Uses yaml.v3 node API to preserve existing comments and formatting.

Usage:
  go run ./cmd/gen-safety --update-profiles            # update all profiles
  go run ./cmd/gen-safety --update-profiles --dry-run  # preview changes

This automates the most tedious part of syncing with upstream: after
new commands are added, running --update-profiles adds the missing
keys to all profiles in one command instead of manual YAML editing.

Rebase safety profiles onto upstream/main (53 new commits up to v0.13.0)
and wire the new commands into the safety profiles.

New upstream commands extracted into _types.go:
- auth credentials remove
- calendar create-calendar
- gmail forward
- gmail labels style
- sheets chart (subtree, single bool gate)
- slides thumbnail

Profile classification per recoverability philosophy (history covers it
= enable, sends to a third party = disable):
- agent-safe: enable style, create-calendar, chart, thumbnail; keep
  forward and credentials.remove disabled (forward is not recoverable;
  agent-safe blocks all auth mutations for parity with other auth flags)
- readonly: enable thumbnail (read-only); disable everything else
- full: enable all
- example: documented with risk levels and disabled by default

Other:
- Restore newGmailService var to gmail.go (matches upstream); remove
  duplicated definition from gmail_types.go
- Drop now-obsolete TestParseTypesFiles assertions for Imports/ExtraCode
  on GmailCmd, since the var lives in gmail.go (always built)

Extract SheetsChartCmd and SheetsNamedRangesCmd into *_types.go so
the generator recognizes their subcommands as YAML keys. Profiles
can now permit read-only chart/named-ranges access without granting
the destructive subcommands.

readonly.yaml now exposes sheets.chart.list/get and
sheets.named-ranges.list/get (previously the entire subtree was
gated on a single boolean and excluded from readonly entirely).

agent-safe.yaml enables all chart subcommands (recoverable via
revision history) and keeps named-ranges writes off (still
conservative about formula reference changes).

Verified by smoke testing each profile:
- readonly: gog sheets chart shows only list/get
- agent-safe: gog sheets chart shows list/get/create/update/delete
- agent-safe and readonly: gog gmail forward absent (unchanged)