feat(cli): numbered menu for require_one_of provider selection

[AbirAbbas]

Summary

Fixes the require_one_of provider prompt in af run / af install. When a
node needed one of several keys (e.g. SWE-AF's ANTHROPIC_API_KEY or
OPENROUTER_API_KEY), the old flow prompted for each option in sequence and
told the user to "fill in one, leave the rest blank" — so to pick OpenRouter you
had to know to press Enter past the Anthropic prompt. There was no visible way
to select. It also rendered the options as ANTHROPIC_API_KEY | OPENROUTER_API_KEY,
which reads poorly.

Before

  This node needs an LLM provider key — fill in one, leave the rest blank:
    ANTHROPIC_API_KEY  |  OPENROUTER_API_KEY
  Enter ANTHROPIC_API_KEY (Anthropic API key (Claude)) [hidden]:

After

  This node needs an LLM provider key — choose one:
    [1]  ANTHROPIC_API_KEY   Anthropic API key (Claude)
    [2]  OPENROUTER_API_KEY  OpenRouter API key (DeepSeek/Qwen/Llama/… — 200+ models)
  Enter 1 or 2 (or press Enter to skip): 2
  Enter OPENROUTER_API_KEY (…) [hidden]:

Typing 2 prompts only OpenRouter — no more guessing which blank does what.

Changes

• Numbered menu for groups with 2+ options: each option on its own line with
  its description; a single line of input selects one, and only the chosen
  provider is then prompted for and persisted. A single-option group still
  prompts directly (no menu).
• "or" instead of "|" everywhere options are enumerated — the menu prompt
  ("Enter 1 or 2 …") and the missing-env error ("at least one of A or B is
  required"), via a small orJoin helper.
• Adds PromptLine to the Prompter interface (an echoed, trimmed line read for
  the selection — never used for secret values); TTYPrompter implements it.

Validation contract / tests

• Menu prompts only the picked option; resolves & persists just that one.
• Selecting the 2nd entry resolves that alternative.
• Invalid / out-of-range selection re-prompts (bounded); exhausting attempts
  leaves the group unsatisfied without prompting for a secret.
• Empty line skips the whole group (→ missing-env error), nothing prompted.
• Selecting an option but leaving its value blank leaves the group unsatisfied.
• Single-option group prompts directly, never consulting the menu.
• orJoin / missing-env wording joins with "or", never "|".
• PromptLine reads a trimmed line from stdin.

Verified end-to-end by driving a real af run swe-planner through a PTY (menu
rendered, selection routed to the right key). internal/packages + internal/ui
suites green; changed files are lint-clean. New functions: promptGroup 90%,
storeGroupOption 89%, orJoin 100%, PromptLine 83% (only error-return
branches uncovered).

🤖 Generated with Claude Code

[github-actions]

📊 Coverage gate

Thresholds from .coverage-gate.toml: per-surface ≥ 84%, aggregate ≥ 85%, max per-surface regression ≤ 1.0 pp, max aggregate regression ≤ 0.50 pp.

Surface	Current	Baseline	Δ
control-plane	86.90%	87.40%	↓ -0.50 pp	🟡
sdk-go	91.90%	92.00%	↓ -0.10 pp	🟢
sdk-python	93.76%	93.73%	↑ +0.03 pp	🟢
sdk-typescript	90.42%	90.42%	→ +0.00 pp	🟢
web-ui	84.75%	84.79%	↓ -0.04 pp	🟡
aggregate	85.54%	85.75%	↓ -0.21 pp	🟡

✅ Gate passed

No surface regressed past the allowed threshold and the aggregate stayed above the floor.

[github-actions]

📐 Patch coverage gate

Threshold: 80% on lines this PR touches vs origin/main (from .coverage-gate.toml:thresholds.min_patch).

Surface	Touched lines	Patch coverage	Status
control-plane	58	89.00%	✅
sdk-go	0	—	➖ no changes
sdk-python	0	—	➖ no changes
sdk-typescript	0	—	➖ no changes
web-ui	0	—	➖ no changes

✅ Patch gate passed

Every surface whose lines were touched by this PR has patch coverage at or above the threshold.