feat: sync managed CLI env placeholders

[michiosw]

Summary

• call the new CLI bootstrap RPC before credential resolution
• generate and update local .env.kontext files additively for managed preset providers
• classify exchange failures, open hosted connect only when it can help, and retry with a bounded window

Dependencies

• requires feat: add CLI bootstrap contract proto#6
• pairs with the backend bootstrap work in kontext-security/kontext

Testing

• go test ./internal/... ./cmd/...

---

[michiosw]

• docs: align CLI env template docs #60
• feat: sync managed CLI env placeholders #61 👈 (View in Graphite)
• main

This stack of pull requests is managed by Graphite. Learn more about stacking.

[michiosw]

Internal review pass complete. The CLI flow now lines up with the intended product behavior: bootstrap before resolution, additive local env sync, typed failure handling, bounded retry, and best-effort launch. I did not find any blocking issues after the final backend pinning and env-sync verification.

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.

[michiosw]

Merge activity

• Apr 14, 10:47 PM UTC: A user started a stack merge that includes this pull request via Graphite.
• Apr 14, 10:47 PM UTC: @michiosw merged this pull request with Graphite.