GRM-18: feat: make --ask-become-pass the default behavior

- Change --ask-become-pass from opt-in to opt-out across all commands
  (install, update, start, stop, enable, disable, status, remove)
- Use Click toggle pattern: --ask-become-pass/--no-ask-become-pass with
  default=True so users are always prompted for sudo unless they
  explicitly opt out
- Update i18n translations for both help texts
- Update all CLI tests to expect ask_become_pass=True as default and
  add test for --no-ask-become-pass
- Update README: remove --ask-become-pass from examples, document
  --no-ask-become-pass for passwordless-sudo setups
- 120 tests, 100% coverage, pyright clean, ruff clean

src/gitea_runner_manager/cli.py

@@ -20,7 +20,11 @@ load_dotenv(override=True)
 
 def _runner_options(func: Callable[..., Any]) -> Callable[..., Any]:
     """Apply common override options for registry-based lifecycle commands."""
-    func = click.option("--ask-become-pass", is_flag=True, help=_("Prompt for sudo password"))(func)
+    func = click.option(
+        "--ask-become-pass/--no-ask-become-pass",
+        default=True,
+        help=_("Prompt for sudo password (default)"),
+    )(func)
     func = click.option("--key", "-k", help=_("Override SSH key from registry"))(func)
     func = click.option("--user", "-u", help=_("Override user from registry"))(func)
     func = click.option("--host", help=_("Override host from registry"))(func)
@@ -85,7 +89,11 @@ def cli() -> None:
     default=lambda: int(os.getenv("GITEA_INTEGRATION_RETRIES", "3")),
     help=_("Integration test API retries (default: 3, env: GITEA_INTEGRATION_RETRIES)"),
 )
-@click.option("--ask-become-pass", is_flag=True, help=_("Prompt for sudo password"))
+@click.option(
+    "--ask-become-pass/--no-ask-become-pass",
+    default=True,
+    help=_("Prompt for sudo password (default)"),
+)
 def install(
     host: str,
     user: str,
@@ -132,7 +140,11 @@ def install(
     default="docker",
     help=_("Gitea Runner deployment mode (default: docker)"),
 )
-@click.option("--ask-become-pass", is_flag=True, help=_("Prompt for sudo password"))
+@click.option(
+    "--ask-become-pass/--no-ask-become-pass",
+    default=True,
+    help=_("Prompt for sudo password (default)"),
+)
 @_handle_errors("Update failed: {error}")
 def update(
     host: str,