fix(tenantctx): expire cached user context by CLI version and age

[ejacquier]

Summary

Fixes DEVSVCS-6566: for bearer-token users the tenants cache (~/.cre/context.yaml) was only refreshed on cre login, so new environments or server-side tenant config changes stayed hidden until a manual re-login.

Each cached environment entry is now stamped with cli_version and fetched_at. On commands that load user context, bearer users refetch when:

• the entry was written by a different CLI version (covers every upgrade path: cre update, Homebrew, install script, manual download, Windows), or
• the entry is older than 24h (contextTTL), or
• the entry has no stamp (cache files written before this change — refetched once).

API-key users are unchanged (always fetch). If a bearer refetch fails (e.g. offline), the stale cached copy is used, preserving today's behaviour.

An earlier iteration of this PR deleted the cache on token refresh and after cre update. That was replaced because it raced with concurrent cre processes (one process deleting context.yaml between another's existence check and read), never ran on Windows or for non-cre update installs, and discarded a valid cache on every token refresh.

Changes

• internal/tenantctx: EnvironmentContext gains FetchedAt / CLIVersion (omitempty); FetchAndWriteContext stamps them; EnsureContext uses isFresh instead of an existence check and falls back to the cache on fetch failure. writeContextFile uses a unique temp file per write so concurrent refreshes can't clobber each other. ClearContext() added.
• cmd/root.go: sets tenantctx.CLIVersion = version.Version (direct import would create a cmd/version → runtime → tenantctx cycle).
• cmd/logout: uses tenantctx.ClearContext() instead of inline removal.

Breaking Changes

• CLI commands, flags or output changed — no
• context.yaml format changed incompatibly — no: two optional fields added; older CLIs ignore them, and pre-existing files are refetched once
• Behaviour change visible to users — minor: bearer users make one extra user-context fetch per 24h and after each CLI version change

Testing Verification

• New unit tests in internal/tenantctx/tenantctx_test.go:
  • TestFetchAndWriteContext_StampsVersionAndTime
  • TestEnsureContext_BearerRefetchesStaleCache (expired / different CLI version / pre-stamp file)
  • TestEnsureContext_BearerFallsBackToStaleCacheOnFetchError
  • TestClearContext_RemovesFile, TestClearContext_MissingFile
• go test ./... -short -skip '<make test-quick skip list>' — all packages pass.
• golangci-lint run on changed packages — 0 issues.
• go build ./... and go vet on changed packages — clean.

🤖 Generated with Claude Code

[github-actions]

👋 ejacquier, thanks for creating this pull request!

To help reviewers, please consider creating future PRs as drafts first. This allows you to self-review and make any final changes before notifying the team.

Once you're ready, you can mark it as "Ready for review" to request feedback. Thanks!