fix(cli): fail closed when OIDC refresh fails

[jhjaggars]

Summary

Stop protected CLI commands before they send RPCs when automatic OIDC token refresh fails. This prevents sandbox create from allocating a persistent sandbox with a stale token and then failing during a later protected RPC.

Related Issue

No issue required: this is an obvious localized authentication bug fix with a focused regression test. Related context: #2675 documents how failed provisioning can leave a same-name sandbox that blocks retry.

Changes

• Propagate authentication preparation failures from protected CLI commands instead of continuing with an expired token
• Preserve openshell status behavior so it can report gateway reachability and authentication independently
• Include the refresh failure and openshell gateway login <name> guidance in the error
• Add an integration regression test proving rejected refresh prevents CreateSandbox from reaching the gateway
• Document the fail-closed OIDC refresh behavior in the CLI skill and gateway authentication reference

Testing

• mise run pre-commit passes
• cargo test -p openshell-cli
• Integration test added for rejected OIDC refresh before sandbox mutation
• E2E tests added/updated (not applicable; no sandbox infrastructure or policy change)

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated (not applicable; no architecture change)

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[elezar]

/ok-to-test f57c5f6

[github-actions]

Label test:e2e applied for f57c5f6. Open the existing run and click Re-run all jobs to execute with the label set. The run will execute the standard E2E suite after building the required gateway and supervisor images once. The matching required CI gate status on this PR will flip green automatically once the run finishes.