docs(cli): document import commit/cancel in the confirmation protocol

This branch routes `import commit` and `import cancel` through
`confirmOrAbort`, so both now return exit code 2 and a
`confirmation_required` envelope in agent sessions. The protocol reference
listed the confirmation-gated write commands as a closed set —
`incidents create/update/resolve`, `deploy`, `destroy` — which no longer
matches the CLI. Add the two import commands to that list.

Also document the pinning behavior the same commands introduce. Both write
their resolved plan back into the `confirmCommand`, so a bare
`checkly import commit` confirms as:

  checkly import commit --plan-id="abc123" --force

carrying a flag the caller never passed. That is deliberate — it stops the
approved run from re-resolving to a plan the user was never shown — but it
looks like noise to an agent that assumes the confirmCommand only ever
repeats what it typed, and the reference gave it no reason to think
otherwise. Say so explicitly, and say not to strip the flag.

Reference-only change: `skills/checkly/SKILL.md` carries the action list,
not reference bodies, so no `sync:skills` regeneration is needed.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: martzoukos

packages/cli/src/ai-context/references/communicate.md

@@ -4,7 +4,7 @@ Open incidents and lead customer communications via status pages.
 
 ## Confirmation Protocol
 
-Write commands (`incidents create`, `incidents update`, `incidents resolve`, `deploy`, `destroy`) require confirmation before executing. When the CLI detects an agent environment, it returns a JSON envelope with exit code 2 instead of executing:
+Write commands (`incidents create`, `incidents update`, `incidents resolve`, `deploy`, `destroy`, `import commit`, `import cancel`) require confirmation before executing. When the CLI detects an agent environment, it returns a JSON envelope with exit code 2 instead of executing:
 
 ```json
 {
@@ -25,6 +25,10 @@ Write commands (`incidents create`, `incidents update`, `incidents resolve`, `de
 4. Use `--dry-run` to preview what a command will do without executing or prompting.
 5. Read-only commands (`incidents list`, `status-pages list`) execute immediately without confirmation.
 
+### Commands that pin a resolved target
+
+A command that picks its own target before confirming writes that target back into the `confirmCommand`. `import commit` and `import cancel` do this: run without `--plan-id` they select the only candidate plan themselves, and confirm as `checkly import commit --plan-id="<resolved-id>" --force` — carrying a flag you never passed. That is deliberate: the pinned ID guarantees the approved run acts on the plan whose `changes` you showed the user, not on whatever happens to be pending by then. Run the `confirmCommand` exactly as returned; do not strip the flag or fall back to the bare command.
+
 ## Available Commands
 
 Parse and read further reference documentation when tasked with any of the following: