feat(onboarding): add env-fingerprint command for agent-driven setup

[ArkNill]

Summary

First deliverable of the LLM-driven onboarding path (Path B): a single,
idempotent command that emits a structured snapshot of the user's local LLM
CLI environment, designed to be consumed by an agent automating an
llm-relay install on the user's behalf.

Background

Onboarding has two paths:

• Path A (human-driven, secondary): llm-relay init walks the user
  through setup interactively. Already exists.
• Path B (LLM-driven, primary focus): an agent (Claude Code / Codex /
  Gemini) reads a playbook + structured probes, and configures the user's
  environment itself. The agent needs structured, parseable input to make
  decisions -- not human-friendly text.

env-fingerprint is the first piece of Path B. Subsequent pieces
(ONBOARDING playbook, llm-relay verify {install,config,integration})
will land in follow-up PRs.

Output

llm-relay env-fingerprint [--format json|yaml] [--no-doctor] [--ports 8080,8083]

Sections (schema_version "1"):

Section	Contents
llm_relay	Package version + on-disk paths (db_dir, db_path, config_path, knowledge_dir)
clis	Per-CLI install/version/auth/config_dir. Registry-keyed so unknown ids never appear and missing CLIs are explicit
ports	free/in_use per probed TCP port
filesystem	home, claude_home, projects_dir, session count, knowledge dir presence
env	Relevant env vars; API keys redacted to set/empty/None so output is safe to paste into bug reports
doctor (optional)	Summary + per-check status from run_doctor

Design notes

• Pure collector: composes existing probes (setup_init._detect_clis,
  orch.discovery.discover_all, recover.doctor.run_doctor,
  detect.scanner). No duplicate detection logic.
• Safe-call wrapping: each sub-probe is wrapped so a single failure
  produces an _error marker on its section without crashing the whole
  snapshot. Partial data is more useful to an agent than no data.
• Idempotent: makes no changes to the user's environment. Safe to run
  repeatedly.
• Schema versioning: SCHEMA_VERSION = "1". Adding new fields does not
  require a bump; agents should ignore unknown fields. Breaking changes bump
  the version.

Test coverage

tests/test_env_fingerprint.py (17 tests):

• Schema shape, doctor toggle, port selection
• CLI registry coverage (all three known ids appear even when binaries
  missing)
• API-key redaction (set/empty/unset)
• Sub-probe failure isolation
• ISO timestamp with timezone
• Schema contract guards

Full suite: 546 pass (529 baseline + 17 new). Ruff clean.

Smoke test

$ llm-relay env-fingerprint --no-doctor | jq '.clis | map({id, installed, auth: .auth.preferred})'
[
  { "id": "claude-code",   "installed": true, "auth": "cli_oauth" },
  { "id": "openai-codex",  "installed": true, "auth": "cli_oauth" },
  { "id": "gemini-cli",    "installed": true, "auth": "cli_oauth" }
]

What's next (separate PRs)

• ONBOARDING playbook (docs/AGENT_SETUP.md or similar) — structured
  guideline that agents follow, with branch conditions and step/verify
  pairs.
• llm-relay verify {install,config,integration} — idempotent verification
  primitives that both Path A and Path B share.