feat(cli): complete the link → checkout agent flow in JSON

[philip]

Overview

Lets an AI agent walk from a linked project to a working DATABASE_URL entirely in
structured JSON, without a human in the loop or any prose to parse.

Two changes:

• checkout gains an --agent mode: a JSON state machine that resolves the project,
  then either returns needs_branch (listing the real branches to choose from, plus a
  next_command_template to retry) or pins the branch, pulls its env, and returns
  checked_out. It never guesses a branch and never silently creates one.

• link --agent no longer reports status: "linked" when a project is linked but no
  branch is pinned. That was a false terminal state: there's no branch and no env yet.
  It now returns needs_branch pointing at checkout --agent, so an agent continues the
  flow instead of stopping one step short of a usable database.

The two commands share one response contract (needs_branch + next_command_template),
so an agent sees a consistent shape across the whole flow. The interactive paths are
untouched; agent mode is an early return.

Note for reviewers: exit code on a failed env pull

checkout --agent pins a branch (local, always succeeds) then pulls its env (remote, can
fail). On a failed pull it reports status: "checked_out", env_pull: "failed", and
exits 0, since the pin genuinely succeeded and the failure lives in the env_pull field.

The risk: an agent that checks the exit code or status (both say "success") could miss
it and fail a later step with no DATABASE_URL; only env_pull flags it. We chose exit 0
for consistency, since every path that pulls env (checkout, link, config apply)
treats a failed pull as a warning, not a command failure. If you'd prefer agent mode to
exit non-zero here, it's a one-line change isolated to the agent path, pinned either way
by an e2e test.

Testing

Unit suites cover the response shapes for both commands. A live e2e
(checkout.e2e.test.ts) provisions a real project and verifies both the successful pull
(connection string written to disk) and the failed pull (branch still pinned, exit 0).

This pull request and its description were written by Isaac.