Confirm before handing a fleet away, and say what a release does

[siliconwitch]

The first of three cycles closing findings from the two architecture reviews of the refactor. This one covers every finding where a user loses something they cannot get back, plus the words attached to those acts.

fleet transfer was the one destructive verb that sent its request with no question asked. Against a stub server, piping n into fleet transfer 3 <address> still sent POST /fleets/{id}/owner and printed success. The server sets owner_id to the target and deletes their membership row, and never re-adds the old owner, so the fleet, its devices and its credit are gone with no way back from the CLI. It now resolves the fleet, names it and the recipient, and reads the answer before sending.

device release asked about the fleet and never the device, so every device in a fleet produced a byte-identical question. A mistyped IMEI landing on another device you own read exactly like the device you meant, and re-claiming needs someone at the hardware pressing its pairing button. It now names the device by its own name, falling back to the IMEI when it has none.

Both verbs told the user a release erases everything on the device. CONTEXT.md and docs/design.md say it clears the fleet, after which the device wipes its files and restarts its code: the firmware, the device key and the SIM identity all survive.

key stands alone nowhere a user reads. The KEY column header stays as it is, because the columns beside it already name the fleet and widening it would skew every row against the server's five-character suffix. That fragility is noted for a later cycle rather than changed here.

Success lines now name what they acted on, the way a question already does.

fleet delete, key create, key revoke and member remove each printed a line no test read, which is how the old wording drifted unnoticed in the first place.

Evidence

• gofmt -l . clean, go mod tidy leaves go.mod and go.sum unchanged, go vet ./... clean, go test -count=1 ./... all ten packages pass with no skips.
• Every new assertion was checked against the deletion it exists to catch, on a copy of the tree: dropping the transfer confirmation, making release print the IMEI instead of the device name, and deleting each of the three success lines each fail the suite.
• The transfer fix was driven end to end against a stub: answering n now stops after GET /fleets and sends no POST, and answering y sends it.

No version change, and nothing under .github, flake.nix, .goreleaser.yaml or go.mod is touched. Paired with a documentation change in superstack-server.