feat(cli): improve provider discoverability for agents and developers

[r3v5]

Problem Statement

AI agents building OpenShell workflows cannot discover the provider credential-hiding path. The provider system is powerful but invisible — agents take the path of least resistance (--env) because --provider requires multi-step setup knowledge that isn't in their context.

Human developers face the same problem: the CLI help for sandbox create doesn't prioritize --provider over --env for credentials, error messages don't suggest providers when connections fail, and there's no command to bridge from "I have these env vars" to "here are the providers I should use."

Proposed Design

1. openshell provider suggest command

New subcommand that matches env var names to built-in profile credential declarations:

$ openshell provider suggest --env JIRA_API_TOKEN=... --env MLFLOW_TRACKING_TOKEN=...

Suggested providers:
  JIRA_API_TOKEN        →  jira (built-in profile)
  MLFLOW_TRACKING_TOKEN →  mlflow (built-in profile)

To set up:
  openshell provider create --name my-jira --type jira --credential JIRA_API_TOKEN
  openshell provider create --name my-mlflow --type mlflow --credential MLFLOW_TRACKING_TOKEN

This gives agents a direct command to discover the right path without reading docs.

2. Updated CLI help text

Reorder openshell sandbox create --help to recommend --provider before --env for credentials. Currently --env appears without context about its security implications.

3. Connection failure hints

When a sandbox connection to a host fails and that host matches a built-in profile's endpoint, include a hint in the error message suggesting the matching profile.

Dependencies

• Depends on feat(providers): ship built-in Jira and MLflow provider profiles #2547 (built-in Jira/MLflow profiles) — provider suggest needs profiles to match against
• Better experience with feat(cli): warn when --env values look like credentials #2548 (CLI credential warnings) — complementary discoverability mechanisms
• Better experience with feat(providers): enable providers v2 by default #2545 (providers v2 default-on) — suggested provider path works without extra setup

Motivation

In opendatahub-io/agent-ops#7, the AI agent building the demo workflow did not know about providers v2. It passed all credentials as --env because that path is obvious and immediately works. provider suggest would have bridged the gap.

Agent Investigation

• Built-in profile credential env var names available via builtin_profiles() in crates/openshell-providers/src/profiles.rs
• openshell provider list-profiles already exists — suggest would add env-var-to-profile matching
• CLI help templates in crates/openshell-cli/src/main.rs (PROVIDER_EXAMPLES, sandbox create help)

Checklist

• Searched for existing issues — no issue tracks provider discoverability for agents
• Design includes three complementary discoverability mechanisms

[krishicks]

I'm unsure about adding provider suggest as a command, because that then assumes the agent (or human) will know to use that command. It's commonly the case that agents will run a command with --help to figure out how to use them, though, and that may be the vector for discovering --env that we want to update. I think a simple solution now is to update the docs for both --provider and --env to make their usage more clear.

Do you think #2603 is sufficient for now?