base +form-submit lacks a pre-submit human confirmation step (preview before irreversible write)

[hehanlin1996]

Problem

When an AI agent uses base +form-submit to fill and submit a Bitable form, there is no way to insert a human review step before the data is actually written. The user wants to preview the exact fields the agent is about to submit, confirm them, and only then commit.

Current behavior:

• +form-submit is Risk: "write", so it submits immediately without any confirmation gate.
• --dry-run previews the API call but exits without continuing.
• --yes only gates high-risk-write commands, which +form-submit was not.

Form submission is irreversible, so this is exactly the case the existing fail-closed confirmation gate is designed for.

Proposal

Promote base +form-submit from write to high-risk-write. This reuses the existing gate with no new command or interactive mechanism:

1. --dry-run previews the exact submit body (the fields to review).
2. The agent shows the preview to the user and waits for confirmation.
3. After confirmation, re-run with --yes to submit. Without --yes, the command returns a structured confirmation_required error (exit 10) and writes nothing.

This matches the precedent set by other base high-risk-write shortcuts (+table-delete, +field-update, the +*-delete family).

Source

Reported via Feishu user feedback (open-platform business line).