feat(cli): guide onboarding and diagnose session readiness

[jiashuoz]

Initial CLI use currently opens a long manual and an unready attach eventually ends in an unexplained WebSocket 503. This change adds compact command help, honest build version reporting, a bounded doctor readiness report, and observed readiness guidance with an exact reattach command after initial retries expire.

Doctor uses the existing identity, runner, environment, and agent routes. Basic session checks require authentication and observed runner capacity; environment/agent setup remains a warning, with installed binaries and provider validity explicitly unverified. It uses a 15-second total budget including ordinary token refresh, bounds requests and bodies, and avoids raw diagnostic bodies, URL secrets, and terminal controls. Existing established-stream reconnect and lifecycle behavior remain intact. The quickstart documents prerequisites, environment/agent setup, and detach/reattach.

Validation: make verify passed (all Go tests, contract gates, builds, vet). Focused tests cover help/version subprocesses, config/auth/status/transport failures, bounded refresh, safe output, runner evidence, optional endpoints, and attach reconnect. A separate built-CLI run against a temporary local synthetic HTTP/WebSocket server verified doctor, new, Ctrl-] detach, reattach, the actual 60.2-second initial wait, Ctrl-C session retention, exactly one creation per command, zero deletions, and unchanged temporary config. Full live infrastructure/GitHub login end-to-end tests are outside this change's authorized verification scope.

No release, tag, npm artifact, provisioning, image, or credential-flow changes. These improvements require a separately authorized future binary/package release to reach installed users; published 0.0.3 is untouched.

Independent and adversarial read-only reviews both pass at 1fa0b5e. Review findings were fixed with permanent regressions: original/rotated credential redaction, normalization and overlapping-token handling, strict bounded JSON validation, malformed optional rows, and optional environment permission warnings.

Follow-up review fixes

Both requested findings are fixed in f765954 and 4e4995d. Development builds now stamp the actual source worktree revision and dirty state; direct unstamped builds report plain dev. Synthetic nested-worktree tests cover distinct parent/worktree commits, opposing dirty states, and exported source without a repository. The timeout/unsafe-ID test uses an atomic counter and waits for the timed-out handler before comparing request counts.

Follow-up adversarial review identified linker-flag precedence; 4ad1e84 preserves effective GOFLAGS and explicit linker arguments. Release overrides and stripping-only builds have permanent regressions and documented version behavior.

Final verification passed: make verify; uncached race tests for cmd/rainier, internal/cli, and internal/attachio; real clean-worktree make build produced rainier dev (4ad1e84), matching git HEAD. Both focused independent and adversarial reviews pass at 4ad1e84. No source changes remain uncommitted; no merge or release was performed. Live credentialed cloud qualification remains outside these fixes.