Summary

Two related changes bundled together since the second was discovered while implementing the first:

1. New b2c bm Data API user administration

Adds full Business Manager user-side administration to the CLI:

• bm users list/get/search/update/delete — OCAPI /users, /user_search
• bm whoami — /users/this (defaults to user-auth)
• bm access-key get/create/set/delete — /users/{login}/access_key/{scope}. [LOGIN] is optional (defaults to whoami), --scope is an enum (WEBDAV_AND_STUDIO/AGENT_USER_AND_OCAPI/STOREFRONT) defaulting to WEBDAV_AND_STUDIO so common usage is b2c bm access-key create to rotate your own WebDAV password.

A new SDK module @salesforce/b2c-tooling-sdk/operations/bm-users wraps the endpoints. Endpoints whose OCAPI documentation states "a valid user is required" (whoami + access-key) extend a BmUserAuthCommand base that defaults authMethods to ['implicit'] — a fresh shell triggers browser login rather than failing with UserNotAvailableException. Explicit --auth-methods / --client-secret overrides still win.

2. CLI table flag consistency refactor

While auditing the new commands I found 22 list commands with copy-pasted getSelectedColumns() helpers and 30 commands with no column-customization at all. This fixes both:

• New SDK helpers columnFlagsFor() / selectColumns() replace the 22 duplicates. printFieldsBlock() does the same for *Get-style label/value detail blocks (5 commands).
• --columns / --extended (-c/-x) added to ~30 commands that lacked them — bm roles list, webdav ls, cap list, code list, content list, docs search, job search, logs list, sites list, slas client list, every mrt/* list command, plus several setup and scaffold commands. webdav ls --extended now exposes the previously-hidden modified and contentType columns.
• Renamed --confirm to --force on the new bm users delete and bm access-key delete commands to match the dominant codebase convention (13 other commands use --force; only 3 use --yes).

Docs + skills

• New b2c-cli:b2c-bm-users-roles skill covers all four bm command groups
• The b2c-am skill is trimmed back to AM-only and defers to the new BM skill
• New docs/cli/bm.md replaces docs/cli/bm-roles.md with comprehensive coverage of all four command groups, including the user-auth defaulting table and access-key scope enum

Test plan

• pnpm run typecheck:agent passes
• pnpm run lint:agent passes
• pnpm run test:agent passes (1705 passing, 6 pending)
• b2c bm --help, b2c bm users --help, b2c bm access-key --help render the new topic tree
• b2c bm whoami triggers browser auth (verified by hitting the login page)
• b2c bm access-key create calls PUT with no body (fixed empty-body issue at the SDK level)
• b2c bm roles list --help, b2c webdav ls --help, etc. show the new -c / -x flags
• Manual verification of b2c bm whoami, bm access-key create, bm access-key get against a real instance
• Manual verification that b2c bm users list (which keeps client-credentials default) works against a service-client setup
• Spot-check a few of the newly-flagged mrt/* list commands render correctly