feat(cli): Add si change-set review command

[stack72]

Adds a new si change-set review command that displays all component changes in a change set in a single, comprehensive view. Users need a quick way to see what has changed in a change set without navigating through the web UI or making multiple API calls. This command provides a clean, terminal-friendly summary of all attribute changes.

# Review a change set by name
si change-set review my-change-set

# Review a change set by ID
si change-set review 01H9ZQD35JPMBGHH69BT0Q79AA

# Include CloudFormation/Terraform code diffs (optional)
si change-set review my-change-set --include-resource-diff

✨ info    si              Found 2 component(s) with changes: 2 added, 0 modified, 0 removed

✨ info    si              Component: my-vpc (AWS::EC2::VPC)
✨ info    si              Status: Added
✨ info    si              All attributes are new:
✨ info    si                + "/domain/cidrBlock"
✨ info    si                    Value: "10.0.0.0/16"
✨ info    si                + "/domain/extra/Region"
✨ info    si                    Value: "$source: region-1 -> /domain/region"
✨ info    si                + "/si/name"
✨ info    si                    Value: "my-vpc"

✨ info    si              Component: existing-subnet (AWS::EC2::Subnet)
✨ info    si              Status: Modified
✨ info    si                ~ "/domain/availabilityZone"
✨ info    si                    Old:
✨ info    si                      Value: "us-east-1a"
✨ info    si                    New:
✨ info    si                      Value: "us-east-1b"

✨ info    si              Summary: 2 added, 0 modified, 0 removed

Implementation Details

Single API Call

Uses the new GET /v1/w/{workspace_id}/change-sets/{change_set_id}/review endpoint that returns:

• All components with changes
• Filtered attribute diffs (no noise like empty defaults or internal fields)
• Subscription source resolution (component names already included)
• Summary statistics

Display Features

Added components:

• Shows "All attributes are new:"
• Displays each new attribute with + prefix

Modified components:

• Shows both old and new values with ~ prefix
• Indented for clarity

Removed components:

• Shows removed attributes with - prefix

Subscription sources:

• Displays as: $source: component-name -> /path
• Makes it clear where values come from

Static values:

• Simple, clean display: "value"

Prototype values:

• Shows function name: $source: AWS_EC2_AMI:getImageIdFromAws()

Error Handling

HEAD change set:

$ si change-set review HEAD
✨ error   si              Cannot review HEAD change set - HEAD has no diffs to review

MVs still building (202 response):

$ si change-set review my-new-changeset
⚠️  warning si              Change set review data is still being generated. Please retry in a few seconds.
✨ info    si              Retry in 2 seconds (estimated completion: 5s)

Change set not found:

$ si change-set review nonexistent
✨ error   si              Change set not found: nonexistent

[github-actions]

Dependency Review

✅ No vulnerabilities or OpenSSF Scorecard issues found.

Scanned Files

None

[vbustamante]

The feature seems very useful! I just feel like we should do a raw string output for the check instead of using the logger, since that' output and not execution logs, and should be printed even if logging is set to silent

[stack72]

The entire CLI output is behind the logger - if our plan is this then we need to rethink how we deal with the logger ingeneral - my thoughts here is that this isn't something we should take on at this time