CLI Phase 4: submit to jobs-manager + watch ingestor Job + summary

[saadqbal]

Part of #147. Phase 4 of 5. Estimated ~4 days. Blocked by Phase 3.

Scope

• Build the request body: same shape as the chart's body.json (ingest_config string, idempotency_key, optional image_digest)
• Idempotency key: generated at command invocation (no replay across invocations); pass --idempotency-key <uuid> for the rare "I want at-most-once across attempts" case
• POST to jobs-manager with the SA token from Phase 2
• Show the 201 response (or surface the 4xx/5xx body verbatim with friendly framing)
• Watch the ingestor Job by name (from the 201 response): poll status, then stream the Pod's logs once it's Running
• Parse the ingestion summary banner (the "📊 INGESTION SUMMARY 📊" block) and render it as a structured panel: rows ingested, files transferred, failures
• Exit code: 0 on full success; non-zero with category for which step failed (auth/staging/submit/ingest)
• --detach flag: print the Job name and exit immediately after the 201

Acceptance criteria

• tracebloc dataset push ./cats-dogs on EKS does the full flow end-to-end and reports "6 files transferred, 576 rows ingested"
• Exit code reflects actual outcome including file-transfer failures (uses the post-feat(client): scaffolding for stateless requests-proxy auth (HC-1) #100 summary that surfaces those)
• --detach works for CI scenarios
• The chart's existing helm install flow keeps working in parallel (no protocol change)

[saadqbal]

Done — PR tracebloc/cli#10 merged into develop. Phase 4 delivered the submit→watch→summary flow + the architectural port-forward fix that makes the laptop UX work. 7 rounds of Bugbot iteration produced ~15 hardening fixes (concurrency, error-routing, ctx-budget separation, detach-reason taxonomy). Final Bugbot verdict: SUCCESS (zero findings). v0.1 happy path is end-to-end working pending the EKS smoke.