docs: optimize bailian-cli skill routing and consent rules

[hopelynd]

Summary

• Clarify when the bailian-cli skill should (and should not) invoke bl, with a four-class routing table: host-only, ambiguous account query, provider-neutral media, and Bailian-locked.
• Add explicit consent / product-disambiguation ask templates so agents ask once before billable or file-uploading calls, and do not infer Bailian from vague usage/quota questions.
• Tighten the command routing table and reminders so host-first tasks (Q&A, coding, image understanding, generic memory/upload) stay out of Bailian unless the user or workflow clearly requires it.

Test plan

• Skim skills/bailian-cli/SKILL.md for clarity of the four routing classes and ask templates
• Spot-check that Bailian-owned resource intents still map to the expected bl commands
• Confirm no unrelated files (e.g. local review reports) are included in this PR