fix(plugin/install): thread cmd through confirmPluginDepsInstall

[ajalon1]

RATIONALE

Part of the RootFactory stack (#802, #803). confirmPluginDepsInstall was closing over a package-level yesFlag variable and passing nil to cli.IsNonInteractive, bypassing the proper flag-read path.

When cmd == nil, IsNonInteractive falls back to the weaker viperx.GetBool(YesFlagName) path instead of reading the flag directly from the command. The package-level yesFlag is also shared state that leaks across successive Execute() calls in tests or any harness that re-uses the same process.

CHANGES

• Remove the package-level var yesFlag bool; re-register the flag via cmd.Flags().BoolP (no package-level binding)
• Thread *cobra.Command through: runInstall → runInstallFromRegistry / runInstallFromFile / runInstallFromURL → checkAndInstallPluginDeps → confirmPluginDepsInstall
• Replace yesFlag || cli.IsNonInteractive(nil) with cli.IsNonInteractive(cmd), which checks --yes via cmd.Flags(), the NON_INTERACTIVE env var, and viperx in priority order
• Update tests: add makeCmd(t, yes bool) helper, remove all origYesFlag/defer cleanup patterns

---

Note

Low Risk
Small CLI plumbing refactor for non-interactive confirmation; no auth, install, or dependency-install logic changes beyond how --yes is read.

Overview
Stops plugin-install dep confirmation from using a package-level yesFlag and cli.IsNonInteractive(nil), which skipped the real --yes flag path and leaked state across Execute() calls.

--yes is now registered without a package binding. runInstall threads *cobra.Command through the file/URL/registry install paths into confirmPluginDepsInstall, which uses cli.IsNonInteractive(cmd) so --yes, env, and viper are resolved in the intended order. Tests use a makeCmd helper instead of mutating global flag state.

^{Reviewed by Cursor Bugbot for commit e3e5760. Configure here.}