Add site cartridge path management commands

[clavery]

Summary

• Add sites cartridges list|add|remove|set CLI commands and corresponding SDK operations (getCartridgePath, addCartridge, removeCartridge, setCartridgePath) for managing the ordered list of active cartridges on a site
• Support Business Manager cartridge path via --bm flag (Sites-Site), which uses site archive import/export since OCAPI only supports reading for BM
• Automatic fallback to site archive import/export when OCAPI direct permissions (/sites/*/cartridges) are unavailable, with actionable error messages when both paths fail
• Default position for add is first; supports first, last, before, after with --target
• Progress reporting via CartridgeUpdateOptions with log callback for phase messages and waitOptions.onProgress for job polling, consistent with job import/job export idiom

Closes #194

Test plan

• b2c sites cartridges list --site-id <id> returns numbered cartridge path
• b2c sites cartridges list --bm returns BM cartridge path
• b2c sites cartridges add <name> --site-id <id> adds via OCAPI
• b2c sites cartridges add <name> --bm adds via site archive import with progress output
• b2c sites cartridges remove <name> --site-id <id> removes cartridge
• b2c sites cartridges set "a:b:c" --bm replaces entire BM path
• --json flag returns structured CartridgePathResult for all commands
• Singular alias works (sites cartridge list)
• OCAPI fallback triggers on 403 with informational messages
• All tests pass: pnpm run test:agent