feat: expose purchased domain auto-renew setting

[Fermionic-Lyu]

Adds insta domain renew <domain> <on|off> [--org <id>] [--json] to change the existing registrar auto-renew setting. It sends only autorenew, validates the mode before any request, and reports the server-returned setting. This does not perform an immediate renewal.

Completes the setting-command portion of #230; display changes are in #343. Platform permissions are unchanged. No MCP tool: updatePurchasedDomain is unclassified and denied for agent credentials by the current platform governance contract; this command explicitly directs users to a human login. The reference change is in the companion skills PR and marked unreleased.

Validation: typecheck, all 2,002 tests across 101 files, real CLI-to-local-HTTP-fixture test, and independent mutation review (including missing command registration and accidental transfer-lock dispatch).

---

Summary by cubic

Adds insta domain renew <domain> <mode> to turn automatic renewal on or off for purchased domains. The command sends only autorenew in the PATCH request, validates on|off before any network call, and prints the server-returned setting rather than assuming the requested state. It does not trigger an immediate renewal.

Completes the setting-command portion of #230; this is the unfolding counterpart.

Bug Fixes

• Rejects invalid modes with mode must be on or off before making any request.
• Reports the actual server setting, so a failed update is visible even with --json.

^{Written for commit b149107. Summary will update on new commits.}

[agent-zhang-beihai]

Reviewed by Wang Miao

This PR adds insta domain renew <domain> on|off. It sends PATCH /orgs/:orgId/domains/:domainName with only { autorenew } set, and prints the setting the platform sends back. I found nothing wrong with it and would approve.

The platform side matches. In instacloud-platform, src/server.ts:3574-3593 accepts autorenew as an optional field and leaves any field you don't send at its current value. src/domains/service.ts:367-376 (updateSettings) asks only for the member role when locked is absent, so this command can't change the transfer lock or need its admin role. The new function follows the same pattern as domainTransferLock (src/commands/domain.ts:220): same on/off check, orgDeps, domainPath encoding and JSON output. The matching docs change required by AGENTS.md rule 4 is open as InsForge/instacloud-skills PR 157.

I couldn't run the tests myself because node_modules isn't installed in this checkout. On the PR, the Linux test job passed and test-windows was still pending when I looked.

[agent-zhang-beihai]

Reviewed by Yang Dong

This correctly adds domain renew with isolated PATCH payloads and human-only guidance. I would request changes because the new command is missing the required agent-facing CLI reference update.

The new command ships without its required agent-facing reference entry

important · judgement · conventions · src/index.ts:307

The repository explicitly requires every command change to be mirrored in the superproject’s skills/insta/cli-reference.md, because that is how agents discover the CLI surface. Add domain renew <domain> <mode> and its options to that reference in the same change set.

Evidence

read-the-code — AGENTS.md:8-17, .claude/skills/developing-insta-cli/SKILL.md:36-38, src/index.ts:307-309

[cubic-dev-ai]

No issues found across 4 files

_{Re-trigger cubic}

[Fermionic-Lyu]

The required reference is already in the same change set: https://github.com/InsForge/instacloud-skills/pull/157/files (head 83c746f6b6b3ec7a7320b2aecb171af0c8486965). It documents syntax, --org, --json, and the human-only permission boundary; both requested reviewers approved it. CLI merges first, then that reference. No duplicate reference belongs inside this repository.

[jwfing]

LGTM - approved.