feat(cmd): add explicit completion subcommand for bash/zsh/fish/powershell (#54)

[mvanhorn]

Closes #54.

Adds `cmd/completion.go` with an explicit `bonsai completion [bash|zsh|fish|powershell]` subcommand. The `Long` help names the install snippets per shell so users can copy-paste without leaving the terminal.

Switched `root.go` from `CompletionOptions.HiddenDefaultCmd` to `DisableDefaultCmd` so the auto-generated completion command does not register at all — otherwise `AddCommand("completion")` in `completion.go` would conflict with it. README "Install" gains a "Shell completion" subsection mirroring the per-shell install snippets.

Out of scope per the issue: completion handlers for `bonsai add ` ability-name arguments — that needs a follow-up issue.

Verified

• `go build ./...` + `go vet ./...` clean
• `go test ./cmd/...` (21 passed)
• `./bonsai --help` lists `completion` between `catalog` and `guide`
• `./bonsai completion bash | head` prints a valid completion script
• `./bonsai completion --help` shows the per-shell install snippets

[LastStep]

Thanks for the contribution @mvanhorn — first external PR to Bonsai 🎉

Merging. Reasoning:

• Scope-clean. Implements Add shell completion via bonsai completion [bash|zsh|fish] #54 acceptance criteria exactly: bonsai completion [bash|zsh|fish|powershell] subcommand, README "Shell completion" section, no behavior changes elsewhere.
• Correct Cobra wiring. The HiddenDefaultCmd → DisableDefaultCmd switch is the right call — the auto-generated default would otherwise collide with the explicit AddCommand("completion"). PR description names this trade-off explicitly.
• Validation is tight. cobra.MatchAll(cobra.ExactArgs(1), cobra.OnlyValidArgs) + ValidArgs rejects bad shells with a helpful error. DisableFlagsInUseLine keeps the usage line clean.
• Help text is install-ready. bonsai completion --help shows per-shell snippets so users can copy-paste without leaving the terminal — nice touch beyond the AC.
• CI green. Lint, go test ./..., go vet ./..., govulncheck, Windows cross-compile, CodeQL — all pass on 397ee43.
• No security/compat surface. New command, stdout-only output, no user input → exec, no schema changes.

Polish items deferred to follow-up issues (none blocking):

1. Stale comment in cmd/completion.go:9-13 references "hide flag" — should read DisableDefaultCmd. Fixing inline post-merge.
2. GenZshCompletion skips descriptions while fish/powershell pass them — minor consistency nit.
3. bonsai completion smoke test (rolls into existing cmd/ coverage backlog item).
4. Ability-name argument completion for bonsai add <skill> — explicitly out-of-scope per Add shell completion via bonsai completion [bash|zsh|fish] #54 hints.

Welcome to the project. 🌱