Implement `basic_cli.py` example

[dgenio]

Summary

Full-flow example demonstrating request → grant → invoke with denial handling.

Behavior

1. Set up registry with 3+ capabilities (READ + WRITE + DESTRUCTIVE)
2. Register InMemoryDriver
3. Show: request capabilities for a goal → print matches
4. Show: attempt WRITE grant without writer role → catch PolicyDenied → print denial
5. Show: add writer role to principal → retry grant → success
6. Show: invoke → print Frame (facts, warnings, handle IDs)
7. Show: expand handle → print expanded data
8. Show: explain action → print trace
9. All output clearly formatted to stdout

Acceptance criteria

• Runs with python examples/basic_cli.py — exit 0
• No internet required
• Output is readable and demonstrates the security model