Add Hosted Cloud onboarding to the am CLI init flow

[ethanj]

Summary

Add a Hosted Cloud onboarding path to am init so users can get a managed AtomicMemory project without Docker or an OpenAI key, alongside credential-handling and installer hardening.

Changes

• Add a Hosted Cloud initialization module that signs in, selects or creates a managed project, and stores a project-bound credential.
• Make Hosted Cloud the default am init path; keep Connected Local available via am init --local, with --project inferring Cloud vs. Local from the resolved project type.
• Scope managed API key names per installation (am-cli-<12-hex>, connected-local-runtime-<12-hex>).
• Prefer the stored project-bound credential over an exported ATOMICMEMORY_API_KEY for init-managed Hosted Cloud profiles; set ATOMICMEMORY_API_KEY_FORCE=1 to restore the environment override, and surface the active credential source in am doctor, am config env show, and am init.
• Harden credential selection and OAuth session handling across CLI commands, and tighten the installer's build-attestation verification.
• Improve the R2 mirror workflow's handling of release assets.
• Update README.md and crates/cli/README.md to document the Hosted Cloud quickstart, project selection, and installer verification flags.
• Bump the workspace version to 0.2.1 ahead of the next CLI release and refresh a transitive dependency.

Validation

pnpm run ci:rust
pnpm run test:mirror-cli-r2
pnpm run test:install-cli