fix(auth): token --confirm error should print the exact invocation

Summary

asc auth token requires --confirm (it prints a bearer token). 88 distinct installs (5.x, 14 days) hit missing_required on it; the command fails 54.6% of the time across 171 installs. The gate is correct; the error is not actionable enough for agents.

Proposed fix

Keep the gate. Make the error print the exact re-invocation (asc auth token --confirm, preserving --profile if given) and one line on why confirmation is required. Keep exit 2 and the diagnostic code unchanged.

Acceptance criteria

• cmdtest asserts the stderr text including the reconstructed invocation