fix(cli): support run-steps SDK method migration

[kj-podonos]

Summary

Compatibility bridge

• make workflows.runs.steps the canonical CLI SDK method path
• fall back to workflows.get_run_steps only when the canonical attribute is genuinely absent
• preserve canonical property failures instead of masking them with the legacy path
• report every attempted method path when neither SDK shape resolves

Contract coverage

• reuse the production resolver in the real-SDK contract suite
• cover canonical resolution, legacy fallback, canonical precedence, descriptor failures, and total misses
• leave the public CLI surface and Fern-generated SDK files unchanged

This bridges the current production SDK shape and the intentional PR #444 rename so regeneration can succeed from backend SHA e9a5532fb90b344901b65f004f26c4d5df90494a.

Test Coverage

CODE PATH COVERAGE
[★★★ TESTED] canonical method resolves
[★★★ TESTED] absent canonical method falls back to legacy
[★★★ TESTED] canonical method wins when both paths exist
[★★★ TESTED] canonical descriptor failure is re-raised
[★★★ TESTED] total miss reports every attempted path
[★★★ TESTED] TABLE rows resolve against the installed generated SDK

• Diff coverage: 100% (23/23 executable changed lines)
• Overall onepin._cli coverage: 93.44%
• Test files: 30 → 30 (+0; resolver cases were added to the existing dispatcher suite)

Pre-Landing Review

No issues found. Independent code/spec/security and architecture/adversarial lanes both returned clear/approve on b7f74c2.

Design Review

No frontend files changed; design review skipped.

Eval Results

No prompt-related files changed; evals skipped.

Greptile Review

No Greptile comments.

Scope Drift

Scope Check: CLEAN. The effective PR diff contains only the two hand-written CLI files and their two test files. The branch history retains commits from an already-merged PR, but those files are not present in this PR's diff.

Plan Completion

The compatibility bridge is complete. Regeneration, generated-client inspection, and release refresh remain intentionally merge-gated downstream steps.

Verification Results

• uv run ruff check src/onepin/_cli tests
• uv run ruff format --check src/onepin/_cli tests
• uv run pytest -q --cov=onepin._cli --cov-report=xml --cov-fail-under=80
• uv run diff-cover coverage.xml --compare-branch=origin/main
• uv run python -m build
• GitHub CI: Python 3.10–3.14 on Ubuntu, macOS, and Windows, plus fresh-wheel/sdist smoke and CodeQL

Test plan

• Current generated SDK resolves the steps command through the legacy fallback
• Canonical and transitional resolver branches have regression coverage
• Package wheel and sdist build successfully
• Repository CI matrix passes
• After merge, regenerate from e9a5532fb90b344901b65f004f26c4d5df90494a
• Verify the regen PR's .spec-sha, generated method parameters, preservation guards, and CI

Release sequencing

After this PR lands, rerun regen.yml with SHA e9a5532fb90b344901b65f004f26c4d5df90494a and verify the new regen PR. Keep release PR #86 unmerged until release-please includes both this bridge and the successful PR #444 SDK regeneration.

Removal criterion: remove the legacy CLI fallback after 0.12.0, the first release containing workflows.runs.steps, ships and regeneration no longer needs compatibility with the pre-rename SDK shape.