fix(cli): render the provision command as a YAML block scalar

[cdotta]

Closes part of #217.

facility-crew.yml and facility-codex.yml are unparseable on any repository where init detects no provision command, so neither agent trigger ever runs:

facility-crew.yml:196:27: could not parse as YAML:
mapping values are not allowed in this context [syntax-check]

196 | run: echo "facility: no provision command configured — the crew runs on a bare checkout...
                       ^~

The command is interpolated into a bare scalar (run: {{PROVISION_CMD}}), and the no-provision fallback text contains facility: . The colon-space ends the scalar.

This is not limited to the fallback — any provision command containing ": " breaks identically:

$ facility init --yes --provision='docker compose up -d && echo "db: ready"'
facility-crew.yml:202:45: could not parse as YAML: mapping values are not allowed in this context

Change

Render the command into a block scalar, matching what checksRun already does for the checks list — including for strings containing ::error::. The message text is unchanged; only its YAML context is.

Verification

• actionlint on both rendered templates across three cases: no provision command, a command containing ": ", and an ordinary command. Clean in all three; the first two fail on main.
• Full CLI test suite passes; node guards/run.mjs clean.
• Also confirmed end to end on a real repository: with this change the workflows parse and the triggers run, where before the push produced two failed runs named by file path.

Deliberately not included

Having doctor parse the workflows it generated would have caught this, and would close the whole class rather than this instance — doctor --run-guards currently reports "Everything checkable checks out" on a repository whose primary workflow cannot be parsed. That is a larger change and I would rather agree the approach first. Detail in #217.