Add safe monitor apply tooling

[jsierles]

We need a repository-controlled way to inventory, validate, and prepare Datadog monitors without ambiguous updates or accidental overnight notifications.

Changes

• Add monitor list, get, validate, and idempotent apply commands
• Match updates by ID or exact name and refuse duplicate-name ambiguity
• Add dry-run and a draft/global-silence safety gate
• Document monitor permissions and add focused tests and help smoke coverage

Test plan

• go test ./...
• bin/build

Assisted-by: Cursor (gpt-5.6-sol)