Bump @primitivedotdev/cli to 0.25.2

[etbyrd]

Summary

• Patch bump after the two AGX Run 9 CLI changes landed:
  • --secret KEY=VALUE on functions:deploy and functions:redeploy
  • Scaffolded handler self-reply guard + REPLY_FROM constant

Test plan

• pnpm lint
• pnpm typecheck
• pnpm test (201 passed)

[greptile-apps]

Greptile Summary

This patch adds pendingKeys to the set-secret error result for both functions:deploy and functions:redeploy, so that when a secret write fails mid-loop, the recovery hint lists every key that was never attempted — not just the one that failed.

• functions-deploy.ts / functions-redeploy.ts: The for…of loop is replaced with an index-based loop so params.secrets.slice(i + 1) can capture all trailing keys at the point of failure; both error-return sites (API error and missing-data guard) now include pendingKeys, and the stderr message is updated to direct the user to re-set all missing keys before redeploying.
• Tests: New assertions confirm pendingKeys === ["THIRD"] when SECOND fails in a three-secret sequence, covering the correctness of both paths.

Confidence Score: 5/5

Safe to merge — the change is additive and tightly scoped to error-path reporting with no impact on the happy path.

Both deploy and redeploy happy paths are unchanged. The new pendingKeys field is only populated and consumed inside the existing set-secret error branch, and the index-based loop is a mechanical transformation of the previous for…of. Tests cover the three-secret failure scenario end-to-end and the 201-test suite passed cleanly.

No files require special attention.

Important Files Changed

Filename	Overview
cli-node/package.json	Patch version bump from 0.25.1 to 0.25.2 — no functional changes.
cli-node/src/oclif/commands/functions-deploy.ts	Adds pendingKeys to the set-secret error result type and computes it mid-loop; updates the stderr recovery hint to list all un-written keys (failed + never-attempted) and point the user to functions:redeploy for the final push.
cli-node/src/oclif/commands/functions-redeploy.ts	Mirrors the pendingKeys change from functions-deploy.ts for the redeploy path; same loop refactor and updated stderr message.
cli-node/tests/oclif/functions-deploy.test.ts	Adds assertion that pendingKeys equals ["THIRD"] when SECOND fails in a three-secret deployment; covers the core correctness of the new field.
cli-node/tests/oclif/functions-redeploy.test.ts	Adds the same pendingKeys assertion for the redeploy path; consistent with the deploy test.

_{Reviews (2): Last reviewed commit: "Surface un-attempted keys when set-secre..." | Re-trigger Greptile}