feat: [ENG-3025] add --response-file and --delete-response-file to brv curate

Lets agents author the curate continuation envelope as a JSON file (no shell-escape
hell) and optionally have brv unlink it after local validation succeeds.

- --response-file <path>: alternative to --response. Reads {html, meta?} from file,
  lstat-guarded against symlinks / directories / devices.
- --delete-response-file (opt-in): unlinks the file once envelope parse + session
  lookup succeed locally, BEFORE daemon dispatch. Validation failures preserve the
  file so the agent can fix and retry; unlink failures abort the curate so we never
  claim success when the requested cleanup did not happen.
- Mutex'd at runtime against --response so failures emit a structured envelope
  error agents can switch on, not oclif's generic stderr line.
- Kickoff-side guard: any continuation-only flag (--response, --response-file,
  --delete-response-file) without --session is rejected up front. Also closes a
  pre-existing silent-ignore on --response without --session.
- All local validation (envelope parse + session existence) now runs before any
  daemon connect; bad JSON no longer triggers withDaemonRetry.

Stdin (--response-file -) deliberately deferred to a follow-up; no codebase
precedent for the dash-as-stdin convention yet.

Docs + skill markdown updated. brv curate --help EXAMPLES shows both flags.