refactor(cli): make IoHost listener removers using-compatible

[mrgrain]

Stacked on #1887.

After the suppressMessages decorator took over the static message drops, the remaining dynamic listeners in CdkToolkit — deploy's approval-framing rewrite, destroy's level override, decline-aborts, and --force responder, and the one-shot listing formatters — still required collecting dispose functions and calling them in a finally block, which is verbose and easy to get wrong.

This change makes the listener registration methods on CliIoHost (on, once, rewrite, rewriteOnce, respond, respondOnce) return a DisposeListener: still a plain callable remover, but also a Disposable, so call sites can bind it with a using declaration and drop the try/finally entirely. Disposal then happens at scope exit, including early returns and throws, and conditional listeners come for free because using x = cond ? ioHost.respondOnce(...) : undefined simply skips disposal for undefined. The repository already relies on TypeScript explicit resource management (using for telemetry timers), so no toolchain change is needed, and the return type change is backwards compatible for every existing caller. Most of the diff in deploy() is the mechanical de-indent from removing its try/finally wrapper.

Tested with a new unit test asserting the remover works as a using resource (listener active inside the block, gone at scope exit), plus the existing decorator and command suites; 234 tests across the affected suites pass and lint is clean.

Checklist

• This change contains a major version upgrade for a dependency and I confirm all breaking changes are addressed
  • Release notes for the new version:

---

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None

[codecov-commenter]

Codecov Report

❌ Patch coverage is 96.13527% with 8 lines in your changes missing coverage. Please review.
✅ Project coverage is 91.34%. Comparing base (8d85981) to head (d21aa20).

Files with missing lines	Patch %	Lines
packages/aws-cdk/lib/cli/cdk-toolkit.ts	95.06%	8 Missing ⚠️

Additional details and impacted files

@@                                 Coverage Diff                                  @@
##           mrgrain/refactor/cli/suppress-messages-decorator    #1888      +/-   ##
====================================================================================
- Coverage                                             91.37%   91.34%   -0.03%     
====================================================================================
  Files                                                    80       80              
  Lines                                                 12254    12261       +7     
  Branches                                               1749     1743       -6     
====================================================================================
+ Hits                                                  11197    11200       +3     
- Misses                                                 1021     1025       +4     
  Partials                                                 36       36              

Flag	Coverage Δ
suite.unit	91.34% <96.13%> (-0.03%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.