feat(armor): --detail flag and ID column for full screened content

[acmck]

What

The getop armor table truncates screened content to a 60-char snippet with no way to see the rest (short of --json). Now:

• Every row ends with a dim ID column — the first 12 chars of the Cloud Logging insertId
• getop armor --detail <id> renders the matching entry as a full card: direction, match state, filters with confidence, template, and the complete untruncated content. A unique prefix of the ID is enough:

$ getop armor --detail 1a2b3c4d
╭──────────────────────── Model Armor entry ────────────────────────╮
│ 2026-07-08T12:05:07+00:00 · response · MATCH_FOUND                │
│ Filters: pi_and_jailbreak(HIGH)                                   │
│ Template: my-armor-template (us)                                  │
│                                                                   │
│ <full screened text, however long>                                │
╰──────────────── 1a2b3c4d-....-full-insert-id ─────────────────────╯

Design notes

• Detail lookup matches any filterMatchState, so IDs copied from an --all table resolve too.
• The ID is validated against insertId's character set before being quoted into the Cloud Logging filter — no way to smuggle filter syntax through it.
• Server-side insertId:"..." is substring matching; client-side, prefix matches win when unambiguous, otherwise all candidates render (each is a self-contained card).
• Not found → exit 1 with a hint to widen --since (default 24h).
• The SENSITIVE banner prints before detail output, same as the table.

Verification

• uv run pytest -q — 149 passed (4 new: filter builder incl. any-state and unsafe-ID rejection, full-content render, ID-column render)
• Live: table shows the ID column; --detail with an 8-char prefix resolved a real entry and rendered its full multi-line content with template and location

🤖 Generated with Claude Code