Add `requiresBash` field to flow metadata

[ameet]

Description

Flows that contain bash steps must be executed with `--allow-bash`:

one --agent flow execute my-flow --allow-bash -i key=value

But there's no way to declare this requirement in the flow definition itself. When `--allow-bash` is omitted, the flow fails with a cryptic error that doesn't mention the missing flag.

Suggestion

Add a `requiresBash` field to flow metadata:

{
  "key": "my-flow",
  "name": "My Flow",
  "requiresBash": true,
  "steps": [...]
}

Behavior:

1. `one --agent flow validate` could warn: "This flow requires --allow-bash"
2. `one --agent flow execute` without `--allow-bash` could produce a clear error: "Flow 'my-flow' requires --allow-bash flag"
3. Could auto-detect from step types (if any step is `type: "bash"`, infer requirement)