feat(cli): shell completions for bash/zsh/fish

[prashar32]

Adds a riskkernel completion <bash|zsh|fish> subcommand that prints a shell completion script to stdout — a small DX win so the CLI tab-completes.

What it does

• Completes the top-level commands (init, serve, chat, runs, audit, policy, approvals, memory, doctor, healthcheck, completion, version, help).
• Completes the nested sub-subcommands: runs list|resume, audit export|tools|compliance, policy validate|dry-run, approvals list|approve|deny, memory list|show, and completion bash|zsh|fish.
• bash and zsh register the rk alias as well.
• Each generated script carries a one-line install hint; the README documents how to wire it into each shell.
• riskkernel completion with no/invalid shell returns a clear usage error naming bash|zsh|fish.

Notes

• Hand-written static scripts — no cobra, no new dependency (keeps the dependency surface minimal). The command/sub-command lists live next to the dispatch switch and are kept in sync with it.
• New file cmd/riskkernel/completion.go with runCompletion(args []string) error, wired into the dispatch switch and usage() in main.go.

Testing

• cmd/riskkernel/completion_test.go covers each shell's generator (non-empty + contains key subcommands and sub-subcommands), the bash/zsh script headers, and the no-arg / invalid-shell error paths.
• Verified the generated bash script passes bash -n, and smoke-tested the built binary for all three shells plus both error paths.
• gofmt -l clean, go vet ./... clean, go test ./... all pass.

Closes #93.