fix(utils): a confirmation could be typed, read, and thrown away

[Denis-hamon]

Stacked on #250. Only the last commit belongs to this pull request.

A confirmation could be typed, read, and thrown away

bufio.Reader.ReadString returns the text it read and an error when the
stream ends without a delimiter. Both confirmation helpers dropped the text on
any error:

answer, err := reader.ReadString('\n')
if err != nil {
    return false          // discards `answer`, even when it is "yes"
}

So an operator who typed an answer and pressed Ctrl-D instead of Enter was
refused, silently, while the guard was holding their answer. Anything actually
typed now counts. Only an empty read is a failure to answer, and that one says
so instead of looking like a decline nobody made.

This is not a way past the guard. A pipe is not an interactive terminal, so
the unattended path refuses before it ever reads. The change only affects
somebody at a keyboard who ended their line with Ctrl-D.

The prompt itself was untestable

confirmInput was injectable so a test could type; the writer was hardcoded to
os.Stderr, so no test could read the question. That asymmetry has already
cost something concrete: a test added in #249 that asserted a server's display
name appeared in the confirmation had to be moved to a service-level unit test,
because the prompt is written outside the channel cmd.Execute captures.

confirmOutput is now injectable alongside it. The wording an operator reads
before erasing a disk is the part worth pinning, and five tests now pin it: it
names the risk, it shows the default, it says which name to type, and it does
not end in a newline — which would push the answer onto the line below the
›.

Not routed through internal/display, and the code says why

Review suggested these prompts should go through internal/display rather than
fmt.Fprintf. Measured against what that package does, it would break the
prompt five ways: every path ends in fmt.Println on stdout, adds a
newline after the ›, JSON-encodes the message under -o json, overwrites the
ResultString global, and — for a warning or an error — calls ExitFunc,
which ends the process. A question is none of those things, and one that
terminated before reading the answer would not be a question.

The layering instinct is right; the target is not. That reasoning is now a
comment above the variables rather than tribal knowledge.

Verification

go test ./..., go vet, make wasm, docgen — all green.

Five sabotages, five red, each on the test meant to catch it:

sabotage	test that fell
restore if err != nil { return false }	HonoursAnAnswerEndedByEOF ×2
drop the unreadable-answer message	SaysSoWhenNothingCouldBeRead
end the prompt with a newline	AsksBeforeItReads
drop the warning from the prompt	AsksBeforeItReads
stop showing the name to type	AsksForTheExactName