#437 feat(cli): add zero-friction Cloud quickstart

Summary

• make bare npx relayfile@latest a clean-machine GitHub quickstart
• perform the localhost Cloud browser login natively, without requiring agent-relay on PATH
• share the canonical ~/.agentworkforce/relay/cloud-auth.json session and lock/refresh behavior
• default the workspace to the current project and mount to ./relayfile-mount
• print the absolute mount path and a ready-to-paste agent prompt
• update the CLI/product contract and hosted setup documentation

Cloud admission prerequisite: AgentWorkforce/cloud#3130. That PR must merge and deploy before this CLI version is published for fresh users.

Verification

• npm run typecheck
• npm test
• scripts/check-contract-surface.sh
• go test ./cmd/relayfile-cli -run 'TestEnsureSetupCloudCredentials|TestQuickStart' -count=1\n- all-platform CLI binary build and npm pack --workspace=packages/cli --dry-run\n- isolated-home npm exec from the packed tarball (relayfile --version => 0.10.46)\n- git diff --check\n\n## Security and compatibility\n- explicit/environment tokens retain precedence and are never silently replaced\n- callback state is random and constant-time validated\n- tokens are never printed and the canonical auth file remains atomic 0600\n- legacy agent-relay sessions remain reusable\n\n## Review gate\nThe configured Veto MCP server returned not ready on repeated attempts, so automated veto_diff_review remains an explicit pre-merge gate. This PR does not deploy production.