feat(hm): pipelines + render commands (machine-readable IR for backend discovery)

[markovejnovic]

What

Two stdout-only subcommands so the Harmont backend can produce pipeline IR by shelling out to hm — no import harmont / pip needed in the render sandbox:

• hm pipelines [--dir DIR] — prints the full discovery envelope JSON
  ({"schema_version":"1","pipelines":[{slug,name,allow_manual,triggers,definition}]})
  via harmont.dump_registry_json().
• hm render <slug> [--dir DIR] — prints that one pipeline's v0 IR JSON
  ({"version":"0","graph":{...}}).

Both write only the raw JSON to stdout; all diagnostics go to stderr; nonzero exit on failure.

Why

The backend's Runloop render sandbox has no harmont Python package, so the old python3 -c 'import harmont' discovery path fails with ModuleNotFoundError. hm already embeds the DSL engine; these commands expose what it already computes (dump_registry_json / render_pipeline_json). The backend will shell out to them (separate change).

How

• DslEngine::registry_json returns the envelope verbatim. Python engine: a new script that sys.stdout.write(hm.dump_registry_json()). TS engine bails explicitly — Python only for now (hm render still works for TS; only the registry dump is deferred).
• Two thin clap handlers (cli/pipelines.rs, cli/render.rs) mirroring cli/run.rs/version.rs; wired into the Command enum + dispatch.

Tests

• hm-dsl-engine/tests/python_engine_test.rs — envelope carries triggers + allow_manual + a v0 definition.
• hm/tests/cmd_pipelines.rs, hm/tests/cmd_render.rs — CLI smoke tests (stdout JSON shape; unknown-slug fails with available slugs on stderr). All self-skip when python3 is absent.

cargo clippy --all-targets -- -D warnings is clean; all new tests pass.

Notes for reviewers

• Contract for the backend: hm pipelines stdout feeds discovery (reads slug/name/allow_manual/triggers; ignores definition). hm render <slug> stdout is one slug's v0 IR.
• This repo's own .harmont/ has both ci.py and ci.ts, so language detection picks TypeScript there — hm pipelines therefore bails with the Python-only message on this repo (by design). hm render ci works.
• Pre-existing, unrelated: cmd_plugin::plugin_list_shows_registered_runners fails identically on main (asserts stdout while the runner list goes to stderr). Not touched by this PR.