Add structured JSON next_steps to workflow commands and a global JSON error envelope

[no-itsbackpack]

Summary

Continues the agent-onboarding work from #1280: agents driving pscale --format json now get actionable, machine-readable remediation on the error path for workflow commands (e.g. move-tables) and on every other command via a global fallback envelope.

Workflow commands

• New internal/cmd/workflow/json.go: shared status / error / issues / next_steps error responses carrying real org/database/branch/workflow values, not placeholders.
• workflow create validates --source-keyspace / --target-keyspace / --tables up front and returns MISSING_FLAGS with a keyspace list discovery command plus a filled-in create example.
• Confirmation-gated commands (cutover, cancel, switch-traffic) without --force return action_required with an approval prompt and the exact --force retry command (including --replicas-only when set), instead of a bare "cannot ... with output format json" error.
• Not-found and API errors on all workflow subcommands return NOT_FOUND / WORKFLOW_ERROR with discovery next_steps (database list, workflow list, workflow show).

Global JSON error envelope

• New cmdutil.ReportGlobalJSONError: any command failing in --format json mode without its own structured JSON now emits a classified {status, code, error, next_steps} envelope on stdout, replacing the old {"error": "..."} blob on stderr.
• Classified codes: NO_AUTH, SERVICE_TOKEN_INVALID, INVALID_FLAG_PLACEMENT, INVALID_USAGE, UNKNOWN_COMMAND, UNKNOWN_FLAG, TTY_REQUIRED, CONFIRMATION_REQUIRED, NOT_FOUND, NETWORK_ERROR, with COMMAND_FAILED as fallback. Each case lists only steps that address that failure — usage errors do not suggest re-authenticating.
• action_required classifications exit 1; everything else exits 2 (or the command's own exit code).
• Root pscale --org mistake now flows through the same classifier in JSON mode; the human-mode hint is unchanged.

Also

• New Agent*Cmd helpers in cmdutil/agent_steps.go for workflow/keyspace commands; deduplicated placeholder rendering.
• Modernized errors.As to errors.AsType in touched files.

Commands that already return structured JSON (auth, sql, mcp install, agent-guide) are unchanged. Success output shapes are unchanged everywhere — no breaking changes for existing JSON consumers.

Test plan

• go test ./internal/cmdutil/... ./internal/cmd/workflow/... ./internal/cmd/sql/... ./internal/cmd/auth/... ./internal/cmd/agentguide/...
• go vet + staticcheck clean on internal/cmdutil and internal/cmd
• gofmt clean
• Manual smoke: pscale workflow cutover <db> <n> --org <org> --format json (no --force) returns CONFIRMATION_REQUIRED with retry command
• Manual smoke: unauthenticated pscale database list --format json returns NO_AUTH envelope on stdout

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 2cac4d5. Configure here.}