Report broken CLI auth probes separately

[wjbright]

Summary

• distinguish failed CLI auth probes from a genuine logged-out state
• surface the CLI diagnostic in onboarding, Doctor, and setup nudges
• route broken CLI installations to Agent runtimes instead of another sign-in loop
• preserve explicit and stderr-empty logged-out behavior for supported CLIs

Why

Buzz previously classified nearly every nonzero login-status probe as logged out. A broken Codex npm shim can fail with an error such as Error: spawn /opt/codex/vendor/bin/codex ENOENT; onboarding then offers Sign in or Check again even though authentication cannot repair the installation.

This introduces a probe_failed state across discovery, readiness, setup payloads, and the desktop UI. Unexpected CLI failures now retain a bounded diagnostic, while recognized logged-out signals still follow the existing authentication flow.

Validation

• cargo test --manifest-path desktop/src-tauri/Cargo.toml managed_agents::readiness::cli_probe::tests
• CARGO_TARGET_DIR=desktop/src-tauri/target cargo test -p buzz-acp nudge_body_cli_probe_failed_routes_to_agent_runtimes
• pnpm --dir desktop test (3,373 passed)
• pnpm --dir desktop typecheck
• pnpm --dir desktop check
• pnpm --dir desktop build:e2e
• pnpm --dir desktop exec playwright test tests/e2e/onboarding-agent-defaults.spec.ts --project=smoke (16 passed)
• just fmt-check
• just desktop-tauri-fmt-check