feat(cli): add yertle nodes list, with the SDK resource behind it

[albertcmiller1]

First command on the refactored layout, and the first proof of the merged CLI+SDK workstream — one endpoint, one implementation, two surfaces.

src/yertle/nodes.py          SDK resource — yertle.nodes.list(org_id)
src/yertle/cli/_context.py   org resolution: --org / $YERTLE_ORG / all
cli/commands/nodes.py        the command — ~20 lines of columns

Pagination — the decision this PR sets

/orgs/{id}/nodes returns 50 at a time. The facade hides it: list() walks every page and returns one complete list, because callers want the graph, not page 1.

docs/sdk/OVERVIEW.md listed this as an open question; it's now marked decided rather than left implicit in the code, since this becomes the precedent for search and every other paginating resource. If a lazy variant is ever wanted, add nodes.iter() beside list() rather than changing its contract.

The loop stops on the reported total or a short/empty page — a total that never catches up can't spin forever. There's a test for exactly that.

Org resolution

--org → $YERTLE_ORG → all. Defaulting to every org rather than erroring matches the Go CLI and suits an orienting command: yertle nodes list with no arguments should show you your world, not a usage error. Blank values are treated as unset, not malformed.

Shape is validated in the CLI so a typo fails with a sentence naming where to find a real id, instead of as a ValueError from inside the SDK.

It lives in cli/, not shared/ — precisely because it never reads config.json. If a persisted default org is added later, it has to be read in shared/auth.py so config access stays in one module (invariant 1). There is no default-org concept in the Python config today; save_credentials writes only api_url and token.

The SDK takes an explicit org_id. No ambient default — hidden global state in a library is miserable to debug, and picking the org is the CLI's job.

Two things the tests caught, not review

The org column is dropped when the listing is already scoped. Two 36-character UUID columns pushed the title clean off an 80-column terminal — test_nodes_list_table_format failed on a missing title, not on anything I'd have noticed by eye. When scoped it's also the same value on every row. Short ids will make this comfortable once the id cache lands for nodes show / tree.

test_yertle_run_refuses_unlisted failed on nodes — the guard added last PR doing its job. Widening the CLI is an API change for the SRE agent, so the allowlist, tool docstring and prompts.py all moved with it, plus a positive test that nodes list is actually admitted.

Verification

make check clean. 133 tests (was 111). 100% coverage on all three new modules.

$ yertle nodes list --help
  --org     -o  TEXT          Organization to act on, or 'all'.
                              Defaults to $YERTLE_ORG, then 'all'.
  --format  -f  [table|json]  Output format. [default: table]

Follow-up

IMPLEMENTATION_PLAN.md's Slice 3 checklist lives in the other repo; happy to tick nodes list and note the pagination decision there in a separate docs PR.

🤖 Generated with Claude Code

https://claude.ai/code/session_01UJhtswytWsBWUbDxPkMvUT