docs(cli): update built-in profiles and groups list

[lukehinds]

Update the profiles and groups documentation to match current built-in policy definitions.

• Replace hyphen bullet separators with em-dashes across all group descriptions
• Update names for split platform groups such as homebrew and go_runtime
• Add missing groups including bun_runtime, mise_manager, and git_config
• Clarify location of the canonical policy definition file

Linked Issue

Closes #1829

Checklist

• An issue exists and is linked above
• All commits are signed-off, using DCO
• All new code follows the project's coding standards (CLAUDE.md) and is covered by tests
• Public-facing changes are paired with documentation updates
• If this PR introduces a major feature, capability, or security-relevant change, a corresponding NEP has been opened or accepted and is linked

[github-actions]

PR Review Summary

Size

Metric	Value
Lines added	+49
Lines removed	-36
Total changed	85
Classification	Medium (50–300 lines)

Affected crates

No crate source directories are directly affected.

Blast radius — Contained

This PR touches: unknown file types

---

_{Updated automatically on each push to this PR.}

[nogent-nolabs-ai]

nogent code review

No blocking issues; 0 findings.

Findings: none flagged in scope.

_{Automated code + security review. CI already covers clippy, rustfmt, tests, cargo-audit and commit-lint.}

[geroldmeisinger]

I would also like to see the actual configuration of the group (=link to code on inline-json).
Protection dangerous_commands. Does this mean I include the group to protect from the commands or exclude?

this is still missing from the docs

[SequeI]

Reopened for tracking