Add audited response apply rehearsal

docs/COMMAND_REFERENCE.md

@@ -319,6 +319,8 @@ Exit code:
 ```bash
 enodia-sentinel respond plan <incident-id>
 enodia-sentinel respond plan <incident-id> --json
+enodia-sentinel respond apply <plan-path-or-plan-id> --dry-run
+enodia-sentinel respond apply <plan-path-or-plan-id> --dry-run --json
 ```
 
 Builds a dry-run response plan from an incident's retained JSON snapshots. The
@@ -341,11 +343,17 @@ saved path. The JSON schema is `enodia.response.plan.v1` and marks
 `apply_supported: false` until an audited apply workflow exists. Dashboard/API
 plan previews remain read-only and do not create new artifacts.
 
+`respond apply` currently supports only `--dry-run`. It reloads a saved plan by
+path, filename, or `plan_id`, prints the exact reviewed actions, and appends a
+`response_apply_rehearsed` audit record with `executed: false`. Running
+`respond apply` without `--dry-run` exits with an error; Sentinel still does not
+execute containment commands.
+
 Exit code:
 
-- `0`: plan generated.
-- `1`: unknown incident id.
-- `2`: missing incident id.
+- `0`: plan generated, or apply rehearsal recorded.
+- `1`: unknown incident id or saved plan reference.
+- `2`: missing id/reference, or `respond apply` requested without `--dry-run`.
 
 ### `status`
 
@@ -498,11 +506,6 @@ does not require pip or a virtualenv.
 
 ## Future Command Contracts
 
-The roadmap reserves these command shapes:
-
-```bash
-enodia-sentinel respond apply <plan-id>
-```
-
 State-changing response commands should be introduced with stable JSON schemas,
-audit logs, and tests before they are documented as supported.
+audit logs, and tests before they are documented as supported. The current
+`respond apply <plan-ref> --dry-run` command is only an audited rehearsal path.