Add one-command Cloud pairing

[abrichr]

What changed

Adds the user-facing openadapt connect command and makes Flow's hosted/keychain support part of the normal launcher install.

• delegates only the fixed pairing, desktop URI, host, device, and destination arguments to the canonical Flow CLI
• preserves openadapt flow connect, the desktop openadapt://connect handoff, and the existing manual login --token path
• binds every launcher install route to openadapt-flow>=1.17.0,<2
• installs the keyring-backed hosted extra in the base package
• aligns launcher metadata with the engine's supported Python 3.10–3.12 range, so unsupported interpreters fail before dependency resolution
• extends release-artifact validation to reject a wheel/sdist whose Requires-Python metadata drifts from pyproject.toml
• updates README guidance, regression coverage, and the reviewed lock resolution

Why

Users should be able to connect a local runtime to the Cloud workspace they already opened without manually copying and storing a long-lived token. A clean launcher install must also resolve an engine that actually contains the transactional pairing state machine.

The browser still cannot execute arbitrary shell commands or browse local files. The one-time claim, keychain staging, credential validation, canonical promotion, idempotent confirmation, exact-token abort, and recoverable rollback semantics remain implemented by openadapt-flow.

Exact upstream binding

The minimum version is the independently verified published Flow v1.17.0:

• release commit: dd00f1f3ac5e3b6177a41c560eed20c95e577c0a
• sole parent: merged pairing commit 062589882596800d6681bfd9e29e5091af518c11
• exact-main CI: 15/15 jobs passed
• wheel SHA-256: 3453559586cc565d490d19a7670d1084e273b9837fe54b5472098c1aa921598b
• sdist SHA-256: 4ec225c957be0f59b3543a2bcb60aff3eea8e35f841e12f7c50ec586b7cf557d

GitHub and PyPI bytes match, and the MIT package boundary plus the hosted CLI/state-machine surface were independently verified.

Validation

• 31 local tests passed; 6 optional sibling-package skips
• Ruff check and format check passed
• release-lock and diff checks passed
• built wheel and sdist passed the release-artifact validator
• clean Python 3.12 install of the built launcher resolved published openadapt-flow==1.17.0 and keyring
• top-level openadapt connect --help, nested openadapt flow connect --help, exact desktop-URI parsing, and existing manual login --help passed against installed artifacts
• malformed pairing input refused before network use
• standard pip on Python 3.14 rejected the wheel with requires a different Python: 3.14.4 not in '<3.13,>=3.10'
• all six macOS/Ubuntu Python 3.10/3.11/3.12 PR jobs passed at exact head 82cc9be916d99d6eea38ca0d2c9f1877f1221f65

This remains a draft until the downstream Cloud/Desktop dependency gates are reviewed.