fix(trace): report rejected CLI credentials at session start
Summary
Before this change, Chainloop Trace used the CLI credentials only in the pre-push hook. When the token expired, the session-start, commit-msg and post-commit hooks did not report it. The developer found out at push time, after the session work was done, and the session was not uploaded.
Now the session-start hook asks the control plane whether the CLI credentials are accepted. It uses the same check as chainloop trace init. When the control plane rejects the credentials, for example because the token expired, the developer is told at the start of the session:
- Claude Code shows the warning in the session banner.
- Cursor and OpenCode have no banner. The agent is told to tell the developer.
The control plane decides if the credentials are valid. The CLI does not inspect the token. The check runs only in control-plane mode, and it stops after 2 seconds. When the control plane is unreachable or slow, the hook shows no warning. The Trace README feature table now has a row for this warning.
Closes PFM-7719
AI disclosure: Claude Code assisted in writing this change.