feat(a2): port leaf PS scripts to ci_orchestrator CLI

Implements Phase A2 of plans/implementation-plan-A-B.md:

- commands/wait.py    -> wait-ready (replaces Wait-VMReady.ps1)

- commands/vm.py      -> vm remove + vm cleanup (replaces Remove-BuildVM.ps1, Cleanup-OrphanedBuildVMs.ps1); cleanup accepts injected VmBackend (Phase C ESXi hook preserved)

- commands/monitor.py -> monitor disk + monitor runner (replaces Watch-DiskSpace.ps1, Watch-RunnerHealth.ps1)

- commands/report.py  -> report job (replaces Get-CIJobSummary.ps1)

Each PS script reduced to a 3-line shim that delegates to the Python CLI and preserves \0.

Tests: 69 pytest cases across new test_commands_*.py modules; ruff clean, mypy --strict clean, coverage 74.5% (>=70 gate).

tests/python/test_cli.py

@@ -12,6 +12,7 @@ import pytest
 from click.testing import CliRunner
 
 import ci_orchestrator.__main__ as cli_module
+import ci_orchestrator.commands.wait as wait_module
 from ci_orchestrator import __version__
 from ci_orchestrator.backends.protocol import VmHandle
 from ci_orchestrator.credentials import Credential
@@ -54,11 +55,11 @@ class _FakeStore:
 
 
 def _patch_common(monkeypatch: pytest.MonkeyPatch, backend: _FakeBackend) -> None:
-    monkeypatch.setattr(cli_module, "load_backend", lambda _cfg: backend)
-    monkeypatch.setattr(cli_module, "KeyringCredentialStore", lambda: _FakeStore())
-    monkeypatch.setattr(cli_module, "WinRmTransport", _FakeTransport)
-    monkeypatch.setattr(cli_module, "SshTransport", _FakeTransport)
-    monkeypatch.setattr(cli_module.time, "sleep", lambda _s: None)
+    monkeypatch.setattr(wait_module, "load_backend", lambda _cfg: backend)
+    monkeypatch.setattr(wait_module, "KeyringCredentialStore", lambda: _FakeStore())
+    monkeypatch.setattr(wait_module, "WinRmTransport", _FakeTransport)
+    monkeypatch.setattr(wait_module, "SshTransport", _FakeTransport)
+    monkeypatch.setattr(wait_module.time, "sleep", lambda _s: None)
 
 
 def test_help_lists_wait_ready() -> None: