Epic: bring the CLI up to the Artifact Keeper 1.6.0 API surface

[brandonrc]

Update ak (currently v1.2.0) to expose all 1.6.0 features. Sequenced: Phase 0 regenerates the vendored SDK from the v1.6.0 OpenAPI spec (foundation), then feature commands build on it.

• Phase 0: regen vendored sdk/ from api v1.6.0 spec + lib.rs re-exports + fix build drift + drop Backend/OpenAPI success-status mismatch (200 vs 201) breaks the strict SDK on create endpoints (artifact push, service-account create, ...) #98 workarounds + bump 1.2.0→1.6.0
• repo.rs: RPM trusted GPG key (#2568) + advanced Debian/APT distribution/component/architecture + Release metadata (#2407/#2460/#2489/#2459) + npm virtual scope policy (#2424)
• scan.rs: CVE blast-radius accessible-not-downloaded disclosure (#2386)
• analytics.rs/repo show: per-repo dedup storage insights (#2056)
• CHANGELOG + regen completions/man-pages

Out of scope: audit-log export (#2413 is a server-side SIEM stream, no REST endpoint). Note: CI does NOT run xtask generate --check, so the regenerated sdk/src/generated_sdk.rs is a committed artifact.