Render a terminal dry-run plan only after setup admission succeeds. Blocked skill or registration plans use the existing remediation output. Reuse one bounded PTY helper for success and refusal workflows; verify no linked target or client configuration changes. Follow-up-to: #3108 Validation: public CLI PTY tests and RPC owner controls pass (77 tests); build and static checks pass.