RFC 0052: managed cluster CLI and device login

[aaltshuler]

What & why

Add managed cluster operations to the existing omnigraph CLI. A folder's .omnigraph/context routes plan/apply/status/history/cancel through the Intent API, and device login stores a short-lived control-plane session in the OS keychain. Applying an exact saved plan depends on current permissions, with no separate managed approval workflow.

Backing issue / RFC

• Is an RFC PR: RFC 0052: Managed control-plane CLI.

RFC 0052 is accepted and implemented after maintainer-authorized review. Its contract covers control-plane operations only; data access remains a separate increment.

Behavior and boundaries

• Context lives only in the selected config directory. Malformed context, unsupported managed verbs, and HTTP/auth failures refuse without invoking Core. Explicit cluster --direct retains the existing cluster.yaml root behavior.
• Control-plane credentials are origin-bound and separate from data-plane credentials. HTTPS, redirect refusal, bounded responses/polls, and native keychain storage have no plaintext credential fallback.
• Apply requires an exact saved --plan. Plan/apply retries retain the idempotency key and request body; cancellation/abandonment retry by run id. Local wait timeout leaves accepted work running.
• JSON preserves API provenance labels and outcome exit codes. Engine, server, and storage behavior is unchanged by this PR.

Validation

• Clean baseline: 91 CLI unit tests and 45 cluster process tests passed before reconciling current main.
• Post-reconciliation: 92 CLI unit tests, 45 cluster process tests, and 86 data process tests passed. Strict CLI Clippy (default and failpoint graphs), formatting, AGENTS/documentation links, and workflow action pins passed.
• Companion control-plane just e2e-cli, using the actual native CLI binary, passed the full kind loop: exact-plan apply, receipt/readiness, idempotency, abandonment replay, cancellation, timeout, and no direct-storage fallback.
• Separate live WorkOS pilot passed device login, real OS keychain storage, plan/apply through readiness, removal/restoration of current apply permission for the same session, and logout. This covers one identity and a nondestructive plan; provider/credential-store fixtures separately cover protocol refusal and expiry cases.
• Full workspace and DST results are reported by CI; merge waits for fresh checks on the reconciled head.

Checklist

• Tests cover the changed public contract and existing direct behavior.
• Public CLI docs, release notes, and RFC disposition updated.
• Reviewed against docs/dev/invariants.md; no invariant weakened or deny-list item introduced.

Companion: og-control-plane #25, stacked on #24. The native kind proof takes an explicit companion CLI binary; an automatic cross-repository CI pin remains outside this PR.