Add a global JSON error envelope with stable codes and next_steps

[no-itsbackpack]

Summary

• Unhandled command errors in --format json mode now print a single structured envelope on stdout: status, error, issues: [{code, message}], next_steps, matching the schema used by auth check, sql, and import d1
• Errors are classified into stable codes (NO_AUTH, NOT_FOUND, CONFIRMATION_REQUIRED, NETWORK_ERROR, INVALID_USAGE, ...) with remediation commands in next_steps
• ANSI color sequences are stripped from messages before they reach JSON payloads
• The error envelope and code vocabulary are documented in the embedded AGENTS.md agent guide
• Workflow-specific JSON handling was reverted out of this PR to keep it focused on the global handler; it can follow separately

Test plan

• go test ./internal/...
• Manual smoke test: pscale database list --org <bogus> --format json returns the NOT_FOUND envelope with discovery next_steps

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit b7ce77a. Configure here.}

[cursor]

Current version of PR was reviewed by /review-bugbot on Jul 8, 20:20. It flagged 2 findings.

Show 2 findings

1. SQL errors always COMMAND_FAILED

internal/cmd/sql/json.go:42 · High Severity

The SQL JSON error path now always sets issues[].code to COMMAND_FAILED for every non-destructive failure, even when the underlying error is clearly auth, not-found, or network-related. That contradicts AGENTS.md, which tells agents to branch on stable issues[].code values such as NO_AUTH and NOT_FOUND.

2. AUTH_INVALID never emitted globally

internal/cmdutil/json_error.go:48 · Medium Severity

AGENTS.md documents AUTH_INVALID as a stable issues[].code for stored credentials rejected by the API, but GlobalJSONError never assigns that code. Rejected-credential failures that do not match the narrower NO_AUTH, SERVICE_TOKEN_INVALID, or other patterns fall through to COMMAND_FAILED.

^{Bugbot on commit 838f2a7 is skipped.}